PT-2016-1801 · Cisco · Cisco Wireless Lan Controller+1

Published 2016-04-20 · Updated 2021-04-26 · CVE-2016-1363

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller Software versions 7.2 through 7.4 before 7.4.140.0(MD) Cisco Wireless LAN Controller Software versions 7.5 through 8.0 before 8.0.115.0(ED)

Description The issue is caused by a buffer overflow in the system redirection functionality. This can be exploited by a remote attacker using a specially crafted HTTP request, potentially allowing the execution of arbitrary code. The vulnerability is due to improper handling of HTTP traffic by the affected software. An attacker could exploit this by sending a crafted HTTP request to an affected device, potentially causing a buffer overflow condition, leading to a denial of service (DoS) condition or allowing the attacker to execute arbitrary code on the device.

Recommendations For versions 7.2 through 7.4, update to version 7.4.140.0(MD) or later. For versions 7.5 through 8.0, update to version 8.0.115.0(ED) or later. As a temporary workaround, consider restricting access to the HTTP URL redirect feature until a patch is available. Avoid using the vulnerable HTTP URL redirect feature in the affected software until the issue is resolved.

Fix

RCE

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2016-01133

CVE-2016-1363

Affected Products

Cisco Wireless Lan Controller

Cisco Wls

References · 5

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-htrd · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01133 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1363 · Security Note
• http://securitytracker.com/id/1035633 · Note