#VU9098 Improper input validation in Aironet - CVE-2017-12274
Published: November 2, 2017
Vulnerability identifier: #VU9098
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-12274
CWE-ID: CWE-287
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerable software:
Aironet
Aironet
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a Layer 2 radio frequency (RF) adjacent attacker to cause DoS condition on the target system.
The weakness exists in Extensible Authentication Protocol (EAP) ingress frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points due to insufficient validation of the EAP frame. A remote attacker can send a malformed EAP frame and cause the AP to reload.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists in Extensible Authentication Protocol (EAP) ingress frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points due to insufficient validation of the EAP frame. A remote attacker can send a malformed EAP frame and cause the AP to reload.
Successful exploitation of the vulnerability results in denial of service.
Remediation
Install update from vendor's website (8.0.152.0, 8.2.164.0, 8.3.132.0, 8.4.100.0).