PT-2023-5644 · Cisco · Cisco Wireless Lan Controller Aireos+1

Published 2023-09-27 · Updated 2024-01-25 · CVE-2023-20251

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) AireOS Software (affected versions not specified)

Description A vulnerability in the memory buffer of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause memory leaks that could eventually lead to a device reboot. This issue is due to memory leaks caused by multiple clients connecting under specific conditions. An attacker could exploit this vulnerability by causing multiple wireless clients to attempt to connect to an access point (AP) on an affected device, resulting in a denial of service (DoS) condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Improper Resource Release

Memory Leak

Weakness Enumeration

CWE-119

CWE-404

CWE-401

Related Identifiers

BDU:2023-06304

CVE-2023-20251

Affected Products

Cisco Wireless Lan Controller Aireos

Cisco Wls

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbw-dos-YSmbUqX3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20251 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20251 · Security Note
• https://bdu.fstec.ru/vul/2023-06304 · Security Note
• https://twitter.com/CVEnew/status/1707087596063457496 · Twitter Post
• https://vuldb.com/?id.240713 · Note
• https://t.me/cibsecurity/71136 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1707140143612637377 · Twitter Post