Lucene search

CiscoCVE-2019-1796

HistoryApr 18, 2019 - 1:29 a.m.

CVE-2019-1796

2019-04-1801:29:02

CWE-20

CWE-399

cisco

web.nvd.nist.gov

cisco

wlc

software

vulnerability

dos

cve-2019-1796

iapp

message handling

CVSS2

6.1

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

22.5%

JSON

A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability exist because the software improperly validates input on fields within IAPP messages. An attacker could exploit the vulnerability by sending malicious IAPP messages to an affected device. A successful exploit could allow the attacker to cause the Cisco WLC Software to reload, resulting in a DoS condition. Software versions prior to 8.2.170.0, 8.5.150.0, and 8.8.100.0 are affected.

Affected configurations

Nvd

Vulners

Node

ciscowireless_lan_controllerRange<8.2.170.0

ciscowireless_lan_controller_softwareRange8.3.143.0–8.5.150.0

ciscowireless_lan_controller_softwareRange8.7.106.0–8.8.100.0

VendorProductVersionCPE
ciscowireless_lan_controller*cpe:2.3:a:cisco:wireless_lan_controller:*:*:*:*:*:*:*:*
ciscowireless_lan_controller_software*cpe:2.3:o:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	wireless_lan_controller	*	cpe:2.3:a:cisco:wireless_lan_controller::::::::
cisco	wireless_lan_controller_software	*	cpe:2.3:o:cisco:wireless_lan_controller_software::::::::

CNA Affected

[
  {
    "product": "Cisco Wireless LAN Controller (WLC)",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "8.2.170.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.3.150.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.8.100.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108008

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-iapp

CVSS2

6.1

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

22.5%

JSON

Related for CVE-2019-1796