PT-2017-12455 · Cisco · Cisco Aironet 2800 Series Access Points+2

Published 2017-11-02 · Updated 2019-10-09 · CVE-2017-12281

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:A/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Aironet 1800, 2800, and 3800 Series Access Points (affected versions not specified)

Description A vulnerability in the implementation of Protected Extensible Authentication Protocol (PEAP) functionality for standalone configurations could allow an unauthenticated, adjacent attacker to bypass authentication and connect to an affected device. The issue exists due to an incorrect default configuration setting of fail open when running in standalone mode. An attacker could exploit this by attempting to connect to an affected device, potentially allowing them to bypass authentication and connect to the device. This issue affects devices running a vulnerable software release with specific WLAN configuration settings, including FlexConnect local switching and central authentication with MAC filtering.

Recommendations For Cisco Aironet 1800, 2800, and 3800 Series Access Points, update the software to a version that fixes the incorrect default configuration setting of fail open in standalone mode. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-12281

Affected Products

Cisco Aironet 1800 Series Access Points

Cisco Aironet 2800 Series Access Points

Cisco Aironet 3800 Series Access Points

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-aironet3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12281 · Security Note
• http://securityfocus.com/bid/101649 · Note
• http://securitytracker.com/id/1039725 · Note