PT-2012-6218 · Cisco · Cisco Wireless Lan Controller+1

Publicado 2012-12-13 · Atualizado 2013-01-30 · CVE-2012-5991

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Média

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller Software version 7.2.110.0

Description The issue allows remote authenticated users to cause a denial of service (device reload) via a certain buttonClicked value in an internal webauth type request. It is due to insufficient validation of user-supplied input to the affected software. An authenticated, remote attacker could exploit the issue by sending crafted HTTP GET requests to the targeted system, causing the vulnerable software to terminate abnormally and denying service to legitimate users. Only users who can authenticate to the affected software could exploit the issue, and affected systems typically have restricted access, limiting the potential for exploitation.

Recommendations For Cisco Wireless LAN Controller Software version 7.2.110.0, as a temporary workaround, consider restricting access to the screens/base/web auth custom.html page until a patch is available. Additionally, restrict access to the internal webauth type request to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2012-5991

Produtos afetados

Cisco Wireless Lan Controller

Cisco Wls

Referências · 5

• 🔥 https://exploit-db.com/exploits/23361 · Exploit
• 🔥 http://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.html · Exploit
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20121213-CVE-2012-5991 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5991 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2012-5991 · Nota de Segurança