PT-2017-9990 · Cisco · Cisco Wireless Lan Controller (Wlc)+1

Published 2017-04-05 · Updated 2017-07-12 · CVE-2016-9194

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) Software versions prior to 8.0.140.0 Cisco Wireless LAN Controller (WLC) Software versions prior to 8.2.130.0 Cisco Wireless LAN Controller (WLC) Software versions prior to 8.3.111.0

Description A vulnerability in 802.11 Wireless Multimedia Extensions (WME) action frame processing could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The issue is due to incomplete input validation of the 802.11 WME packet header. An attacker could exploit this by sending malformed 802.11 WME frames to a targeted device, potentially causing the WLC to reload unexpectedly.

Recommendations For versions prior to 8.0.140.0, update to version 8.0.140.0 or later. For versions prior to 8.2.130.0, update to version 8.2.130.0 or later. For versions prior to 8.3.111.0, update to version 8.3.111.0 or later.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-9194

Affected Products

Cisco Wireless Lan Controller (Wlc)

Cisco Wls

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9194 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9194 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-wlc · Vendor Advisory
• http://securitytracker.com/id/1038182 · Note
• http://securityfocus.com/bid/97424 · Note