Input validation error in Cisco IOS Access Points Software (APs) - CVE-2019-1920
Published: July 18, 2019
Vulnerability identifier: #VU19250
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1920
CWE-ID: CWE-20
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to perform a denial of service (DoS) attack.
The vulnerability exists due a lack of complete error handling condition for client authentication requests sent to the 802.11r Fast Transition (FT) implementation. An attacker can send crafted authentication request traffic to the targeted interface and cause the device to restart unexpectedly.
Affected software
Cisco IOS Access Points Software (APs)
How to mitigate CVE-2019-1920
Install updates from vendor's website.
Cisco IOS Access Points Software (APs) - addressed in versions 8.2.170.0, 8.3.150.0, 8.5.131.0, 8.8.100.0