PT-2017-3405 · Cisco · Cisco Wireless Lan Controllers+1

Published 2017-11-01 · Updated 2019-10-09 · CVE-2017-12280

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controllers (affected versions not specified)

Description A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) Discovery Request parsing functionality could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. The issue is due to incomplete input validation of fields in CAPWAP Discovery Request packets by the affected device. An attacker could exploit this by sending crafted CAPWAP Discovery Request packets to an affected device, potentially causing it to restart and resulting in a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2018-00193

CVE-2017-12280

Affected Products

Cisco Wireless Lan Controllers

Cisco Wls

References · 7

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-wlc3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12280 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-wlc3 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12280 · Security Note
• https://bdu.fstec.ru/vul/2018-00193 · Security Note
• http://securityfocus.com/bid/101646 · Note
• http://securitytracker.com/id/1039723 · Note