Lucene search

CiscoCVE-2019-1805

HistoryApr 18, 2019 - 1:29 a.m.

CVE-2019-1805

2019-04-1801:29:02

CWE-20

CWE-284

cisco

web.nvd.nist.gov

cisco

wlc

ssh

server

access control

vulnerability

cve-2019-1805

nvd

security

exploit

cli

CVSS2

3.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

20.9%

JSON

A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to access a CLI instance on an affected device. The vulnerability is due to a lack of proper input- and validation-checking mechanisms for inbound SSH connections on an affected device. An attacker could exploit this vulnerability by attempting to establish an SSH connection to an affected controller. An exploit could allow the attacker to access an affected device’s CLI to potentially cause further attacks. This vulnerability has been fixed in version 8.5(140.0).

Affected configurations

Nvd

Vulners

Node

ciscowireless_lan_controller_softwareMatch8.3\(141.0\)

VendorProductVersionCPE
ciscowireless_lan_controller_software8.3(141.0)cpe:2.3:a:cisco:wireless_lan_controller_software:8.3\(141.0\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	wireless_lan_controller_software	8.3(141.0)	cpe:2.3:a:cisco:wireless_lan_controller_software:8.3\(141.0\):::::::*

CNA Affected

[
  {
    "product": "Cisco Wireless LAN Controller (WLC)",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "8.5(140.0)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108003

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-ssh

CVSS2

3.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

20.9%

JSON

Related for CVE-2019-1805