Denial of Service Vulnerability in Cisco Aironet Access Points
CVE-2017-12274

6.5MEDIUM

Key Information:

Vendor
Cisco
Status
Cisco Aironet 1560, 2800, And 3800 Series Access Point Platforms
Vendor
CVE Published:
2 November 2017

Summary

A vulnerability exists within the Extensible Authentication Protocol (EAP) frame processing of Cisco Aironet 1560, 2800, and 3800 Series Access Points. This issue arises from inadequate validation of the EAP frame, which could be exploited by an unauthenticated, Layer 2 adjacent attacker. By sending a malformed EAP frame to the targeted access point, the attacker may trigger a reload of the device, consequently leading to a denial of service condition. Users may need to power cycle the device manually for it to return to normal operation. The affected devices are those running either the Lightweight AP Software or Mobility Express image.

Affected Version(s)

Cisco Aironet 1560, 2800, and 3800 Series Access Point Platforms Cisco Aironet 1560, 2800, and 3800 Series Access Point Platforms

References

http://www.securitytracker.com/id/1039715
vdb-entryx_refsource_SECTRACK
https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/101648
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.