CVSS: 10.0EPSS: 7%CPEs: 18EXPL: 0CVE-2019-15260 – Cisco Aironet Access Points Unauthorized Access Vulnerability
https://notcve.org/view.php?id=CVE-2019-15260
16 Oct 2019 — A vulnerability in Cisco Aironet Access Points (APs) Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device with elevated privileges. The vulnerability is due to insufficient access control for certain URLs on an affected device. An attacker could exploit this vulnerability by requesting specific URLs from an affected AP. An exploit could allow the attacker to gain access to the device with elevated privileges. While the attacker would not be granted access... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-unauth-access • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2019-1654 – Cisco Aironet Series Access Points Development Shell Access Vulnerability
https://notcve.org/view.php?id=CVE-2019-1654
17 Apr 2019 — A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could allow an authenticated, local attacker to access the development shell without proper authentication, which allows for root access to the underlying Linux OS. The attacker would need valid device credentials. The vulnerability exists because the software improperly validates user-supplied input at the CLI authentication prompt for development shell a... • http://www.securityfocus.com/bid/107991 • CWE-255: Credentials Management Errors CWE-306: Missing Authentication for Critical Function •