Lucene search

CiscoCVE-2017-12280

HistoryNov 02, 2017 - 4:29 p.m.

CVE-2017-12280

2017-11-0216:29:00

CWE-119

cisco

web.nvd.nist.gov

cve-2017-12280

cisco

wireless lan controllers

capwap

dos

nvd

security vulnerability

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.9%

JSON

A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) Discovery Request parsing functionality of Cisco Wireless LAN Controllers could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of fields in CAPWAP Discovery Request packets by the affected device. An attacker could exploit this vulnerability by sending crafted CAPWAP Discovery Request packets to an affected device. A successful exploit could allow the attacker to cause the affected device to restart unexpectedly, resulting in a DoS condition. Cisco Bug IDs: CSCvb95842.

Affected configurations

Nvd

Node

ciscowireless_lan_controller_softwareMatch-

AND

ciscowireless_lan_controllerMatch-

VendorProductVersionCPE
ciscowireless_lan_controller_software-cpe:2.3:o:cisco:wireless_lan_controller_software:-:*:*:*:*:*:*:*
ciscowireless_lan_controller-cpe:2.3:h:cisco:wireless_lan_controller:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	wireless_lan_controller_software	-	cpe:2.3:o:cisco:wireless_lan_controller_software:-:::::::*
cisco	wireless_lan_controller	-	cpe:2.3:h:cisco:wireless_lan_controller:-:::::::*

CNA Affected

[
  {
    "product": "Cisco Wireless LAN Controller",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Wireless LAN Controller"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101646

www.securitytracker.com/id/1039723

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-wlc3

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.9%

JSON

Related for CVE-2017-12280