PT-2024-1591 · Cisco · Cisco Wap371 Wireless-Ac/N Dual Radio Access Point
Pierre Martin
·
Published
2024-01-10
·
Updated
2024-02-02
·
CVE-2024-20287
CVSS v2.0
8.3
High
| Vector | AV:N/AC:L/Au:M/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) versions prior to 1.3.0.8
Description
A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device. This is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. The attacker must have valid administrative credentials for the device to exploit this vulnerability.
Recommendations
For Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) versions prior to 1.3.0.8:
Apply network restrictions to protect appliances, as the device has reached end-of-life and no firmware updates will be released to patch this security flaw.
Consider disabling remote access to the web-based management interface until further mitigation measures can be applied.
Restrict access to the device to minimize the risk of exploitation, as no patch will be available for this vulnerability.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Argument Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Wap371 Wireless-Ac/N Dual Radio Access Point