PT-2015-4838 · Cisco · Cisco Wireless Lan Controller+1

Publicado 2015-05-08 · Atualizado 2017-01-06 · CVE-2015-0723

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) versions 7.5.x through 7.6.119

Description A denial of service issue exists due to improper input sanitization of a certain value supplied by a user prior to authentication. An attacker could exploit this by sending a request that triggers the issue, causing a process crash and device restart. The vulnerability can be exploited by an unauthenticated, adjacent attacker with access to the same broadcast or collision domain as the targeted device.

Recommendations For versions 7.5.x through 7.6.119, update to a fixed software version, such as 7.6.120 or later, to resolve the issue. As a temporary workaround, consider restricting access to the wireless web authentication subsystem to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-0723

Produtos afetados

Cisco Wireless Lan Controller

Cisco Wls

Referências · 5

• http://tools.cisco.com/security/center/viewAlert.x?alertId=38749 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150508-CVE-2015-0723 · Aviso do Fabricante
• http://securitytracker.com/id/1032277 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-0723 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0723 · Nota de Segurança