PT-2017-12413 · Cisco · Cisco Ios Xe+2

Published 2017-09-27 · Updated 2019-10-09 · CVE-2017-12222

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 16.1 through 16.3.3

Description A vulnerability in the wireless controller manager could allow an unauthenticated, adjacent attacker to cause a restart of the switch and result in a denial of service (DoS) condition. The issue is due to insufficient input validation, and an attacker could exploit it by submitting a crafted association request to cause the switch to restart. This affects Cisco Catalyst 3650 and 3850 switches running IOS XE Software and acting as wireless LAN controllers (WLC).

Recommendations For Cisco IOS XE versions 16.1 through 16.3.3, update to a fixed version of the software to address the vulnerability.

Fix

DoS

RCE

Weakness Enumeration

CWE-399

CWE-20

Related Identifiers

CVE-2017-12222

Affected Products

Cisco Catalyst 3650

Cisco Catalyst 3850

Cisco Ios Xe

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ios-xe · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12222 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12222 · Vendor Advisory
• http://securitytracker.com/id/1039458 · Note
• http://securityfocus.com/bid/101035 · Note