PT-2019-3870 · Cisco · Cisco Wireless Lan Controller+1

Published 2019-10-16 · Updated 2020-10-09 · CVE-2019-15262

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) Software (affected versions not specified)

Description A vulnerability in the Secure Shell (SSH) session management could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the SSH process is not properly deleted when an SSH connection to the device is disconnected. An attacker could exploit this vulnerability by repeatedly opening SSH connections to an affected device, exhausting system resources and resulting in a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Improper Resource Release

Weakness Enumeration

CWE-20

CWE-404

Related Identifiers

BDU:2019-04261

CVE-2019-15262

Affected Products

Cisco Wireless Lan Controller

Cisco Wls

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-15262 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-wlc-ssh-dos · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04261 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15262 · Vendor Advisory