PT-2007-3379 · Cisco · Cisco Wireless Lan Controller+1

Published 2007-04-12 · Updated 2018-10-30 · CVE-2007-2036

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) versions prior to 20070419

Description The issue concerns the SNMP implementation in the Cisco Wireless LAN Controller, which uses default community strings, allowing remote attackers to access and modify SNMP variables. Additionally, the WLC contains multiple vulnerabilities that could lead to a denial of service condition, information disclosure, access control list changes, or allow an attacker to gain full administrative access.

Recommendations For versions prior to 20070419, update to a version released after 20070419 to address the vulnerabilities. As a temporary workaround, consider changing the default read-only and read-write community strings to custom values to prevent unauthorized access. Restrict access to the SNMP service to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-2036

Affected Products

Cisco Wireless Lan Controller

Cisco Wls

References · 9

• http://securitytracker.com/id?1017908 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070412-wlc · Vendor Advisory
• http://cisco.com/warp/public/707/cisco-sa-20070412-wlc.shtml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-2036 · Security Note
• http://vupen.com/english/advisories/2007/1368 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33604 · Note
• http://securityfocus.com/bid/23461 · Note
• http://osvdb.org/34134 · Note