CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2019-15260

CVSS 9.8v3.1pub. 2019-10-16upd. 2024-11-21

A vulnerability in Cisco Aironet Access Points (APs) Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device with elevated privileges. The vulnerability is due to insufficient access control for certain URLs on an affected device. An attacker could exploit this vulnerability by requesting specific URLs from an affected AP. An exploit could allow the attacker to gain access to the device with elevated privileges. While the attacker would not be granted access to all possible configuration options, it could allow the attacker to view sensitive information and replace some options with values of their choosing, including wireless network configuration. It would also allow the attacker to disable the AP, creating a denial of service (DoS) condition for clients associated with the AP.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cisco Aironet 1540

    HW
    Cisco
    all versions

  • Cisco Aironet 1540 Firmware

    OS
    Cisco
    8.8 – 8.8.120.0 (excl.)8.5 – 8.5.151.0 (excl.)

  • Cisco Aironet 1560

    HW
    Cisco
    all versions

  • Cisco Aironet 1560 Firmware

    OS
    Cisco
    8.8 – 8.8.120.0 (excl.)8.5 – 8.5.151.0 (excl.)

  • Cisco Aironet 1800

    HW
    Cisco
    all versions

  • Cisco Aironet 1800 Firmware

    OS
    Cisco
    8.5 – 8.5.151.0 (excl.)8.8 – 8.8.120.0 (excl.)

  • Cisco Aironet 2800

    HW
    Cisco
    all versions

  • Cisco Aironet 2800 Firmware

    OS
    Cisco
    8.5 – 8.5.151.0 (excl.)8.8 – 8.8.120.0 (excl.)

  • Cisco Aironet 3800

    HW
    Cisco
    all versions

  • Cisco Aironet 3800 Firmware

    OS
    Cisco
    8.5 – 8.5.151.0 (excl.)8.8 – 8.8.120.0 (excl.)

  • Cisco Aironet 4800

    HW
    Cisco
    all versions

  • Cisco Aironet 4800 Firmware

    OS
    Cisco
    8.5 – 8.5.151.0 (excl.)8.8 – 8.8.120.0 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2022-20695CRITICAL10.0PL ✓same product

Cisco WLC — pominięcie uwierzytelnienia przez management interface

CVE-2021-34740HIGH7.4same product

A vulnerability in the WLAN Control Protocol (WCP) implementation for Cisco Aironet Access Point (AP) software...

CVE-2021-1419HIGH7.8same product

A vulnerability in the SSH management feature of multiple Cisco Access Points (APs) platforms could allow a lo...

CVE-2021-1437HIGH7.5same product

A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow ...

CVE-2021-1439HIGH7.4same product

A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco Aironet Series Access Points Software cou...