CVSS: 4.7EPSS: 0%CPEs: 9EXPL: 0CVE-2023-20268 – Cisco Access Point Software Uncontrolled Resource Consumption Vulnerability
https://notcve.org/view.php?id=CVE-2023-20268
27 Sep 2023 — A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device. This vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker could exploit this vulnerability by sending a series of specific wireless packets to an affected device. A successful exploit could allow the attacker to consume resources on an affected device. A sustained at... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-dos-capwap-DDMCZS4m • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 95EXPL: 0CVE-2021-1419 – Cisco Access Points SSH Management Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-1419
23 Sep 2021 — A vulnerability in the SSH management feature of multiple Cisco Access Points (APs) platforms could allow a local, authenticated user to modify files on the affected device and possibly gain escalated privileges. The vulnerability is due to improper checking on file operations within the SSH management interface. A network administrator user could exploit this vulnerability by accessing an affected device through SSH management to make a configuration change. A successful exploit could allow the attacker to... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-ap-LLjsGxv • CWE-284: Improper Access Control •
CVSS: 4.4EPSS: 0%CPEs: 16EXPL: 0CVE-2021-1423 – Cisco Aironet Access Points Arbitrary File Overwrite Vulnerability
https://notcve.org/view.php?id=CVE-2021-1423
24 Mar 2021 — A vulnerability in the implementation of a CLI command in Cisco Aironet Access Points (AP) could allow an authenticated, local attacker to overwrite files in the flash memory of the device. This vulnerability is due to insufficient input validation for a specific command. An attacker could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to overwrite or create files with data that is already present in other files that are hosted on the af... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-foverwrt-HyVXvrtb • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.7EPSS: 0%CPEs: 17EXPL: 0CVE-2021-1449 – Cisco Access Point Software Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-1449
24 Mar 2021 — A vulnerability in the boot logic of Cisco Access Points Software could allow an authenticated, local attacker to execute unsigned code at boot time. The vulnerability is due to an improper check that is performed by the area of code that manages system startup processes. An attacker could exploit this vulnerability by modifying a specific file that is stored on the system, which would allow the attacker to bypass existing protections. A successful exploit could allow the attacker to execute unsigned code a... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-privesc-wEVfp8Ud • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2021-1437 – Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-1437
24 Mar 2021 — A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol (TFTP) configuration. An attacker could exploit this vulnerability by sending a specific TFTP request to an affected device. A successful exploit could allow the attacker to download any file from the filesystem of the affected ac... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-info-disc-BfWqghj • CWE-275: Permission Issues •
CVSS: 8.6EPSS: 2%CPEs: 4EXPL: 0CVE-2019-15262 – Cisco Wireless LAN Controller Secure Shell Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-15262
16 Oct 2019 — A vulnerability in the Secure Shell (SSH) session management for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the SSH process is not properly deleted when an SSH connection to the device is disconnected. An attacker could exploit this vulnerability by repeatedly opening SSH connections to an affected device. A successful exploit could allow the attacker to exha... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-wlc-ssh-dos • CWE-20: Improper Input Validation CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 0CVE-2017-3832
https://notcve.org/view.php?id=CVE-2017-3832
06 Apr 2017 — A vulnerability in the web management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a missing internal handler for the specific request. An attacker could exploit this vulnerability by accessing a specific hidden URL on the GUI web management interface. A successful exploit could allow the attacker to cause a reload of the device, resulting in a DoS cond... • http://www.securityfocus.com/bid/97421 • CWE-264: Permissions, Privileges, and Access Controls CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-9219
https://notcve.org/view.php?id=CVE-2016-9219
06 Apr 2017 — A vulnerability with IPv6 UDP ingress packet processing in Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause an unexpected reload of the device. The vulnerability is due to incomplete IPv6 UDP header validation. An attacker could exploit this vulnerability by sending a crafted IPv6 UDP packet to a specific port on the targeted device. An exploit could allow the attacker to impact the availability of the device as it could unexpectedly reload. This vulnerab... • http://www.securityfocus.com/bid/97423 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 1%CPEs: 16EXPL: 0CVE-2017-3854
https://notcve.org/view.php?id=CVE-2017-3854
15 Mar 2017 — A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote attacker to impersonate a WLC in a meshed topology. The vulnerability is due to insufficient authentication of the parent access point in a mesh configuration. An attacker could exploit this vulnerability by forcing the target system to disconnect from the correct parent access point and reconnect to a rogue access point owned by the attacker. An exploit could allow the attacker to control... • http://www.securityfocus.com/bid/96911 • CWE-287: Improper Authentication •