PT-2015-3190 · Cisco · Cisco Wireless Lan Controller

Published 2015-08-22 · Updated 2017-01-04 · CVE-2015-6258

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller version 8.1(104.37)

Description The issue concerns the Internet Access Point Protocol (IAPP) module, which allows remote attackers to trigger incorrect traffic forwarding via crafted IPv6 packets. This is due to insufficient input validation in the module.

Recommendations For version 8.1(104.37), consider restricting access to the IAPP module to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00560

CVE-2015-6258

Affected Products

Cisco Wireless Lan Controller

References · 4

• https://bdu.fstec.ru/vul/2016-00560 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6258 · Security Note
• http://securitytracker.com/id/1033360 · Note