CVE-2020-3273

Cisco Wireless LAN Controller 802.11 Generic Advertisement Service Denial of Service Vulnerability

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the 802.11 Generic Advertisement Service (GAS) frame processing function of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS). The vulnerability is due to incomplete input validation of the 802.11 GAS frames that are processed by an affected device. An attacker could exploit this vulnerability by sending a crafted 802.11 GAS frame over the air to an access point (AP), and that frame would then be relayed to the affected WLC. Also, an attacker with Layer 3 connectivity to the WLC could exploit this vulnerability by sending a malicious 802.11 GAS payload in a Control and Provisioning of Wireless Access Points (CAPWAP) packet to the device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS.

Una vulnerabilidad en la función de procesamiento de trama 802.11 Generic Advertisement Service (GAS) del Software Cisco Wireless LAN Controller (WLC) podría permitir a un atacante no autenticado remoto causar la recarga de un dispositivo afectado, resultando en una denegación de servicio (DoS). La vulnerabilidad es debido a la comprobación de entrada incompleta de las tramas 802.11 GAS procesadas por un dispositivo afectado. Un atacante podría explotar esta vulnerabilidad mediante el envío de una trama GAS 802.11 diseñada por aire hacia un punto de acceso (AP), y esa trama se transmitiría al WLC afectado. Adicionalmente, un atacante con conectividad de Capa 3 al WLC podría explotar esta vulnerabilidad mediante el envío de una carga maliciosa 802.11 GAS en un paquete Control and Provisioning of Wireless Access Points (CAPWAP) hacia el dispositivo. Una explotación con éxito podría permitir al atacante causar que el dispositivo afectado se recargue, resultando en una DoS.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-12-12 CVE Reserved
2020-04-15 CVE Published
2023-03-07 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-gas-dos-8FsE3AWH	2020-04-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"	5508 Wireless Controller Firmware Search vendor "Cisco" for product "5508 Wireless Controller Firmware"	8.5\(151.0\) Search vendor "Cisco" for product "5508 Wireless Controller Firmware" and version "8.5\(151.0\)"	-	Affected	in	Cisco Search vendor "Cisco"	5508 Wireless Controller Search vendor "Cisco" for product "5508 Wireless Controller"	-	-	Safe
Cisco Search vendor "Cisco"	5508 Wireless Controller Firmware Search vendor "Cisco" for product "5508 Wireless Controller Firmware"	8.10\(204.92\) Search vendor "Cisco" for product "5508 Wireless Controller Firmware" and version "8.10\(204.92\)"	-	Affected	in	Cisco Search vendor "Cisco"	5508 Wireless Controller Search vendor "Cisco" for product "5508 Wireless Controller"	-	-	Safe
Cisco Search vendor "Cisco"	5520 Wireless Controller Firmware Search vendor "Cisco" for product "5520 Wireless Controller Firmware"	8.5\(151.0\) Search vendor "Cisco" for product "5520 Wireless Controller Firmware" and version "8.5\(151.0\)"	-	Affected	in	Cisco Search vendor "Cisco"	5520 Wireless Controller Search vendor "Cisco" for product "5520 Wireless Controller"	-	-	Safe
Cisco Search vendor "Cisco"	5520 Wireless Controller Firmware Search vendor "Cisco" for product "5520 Wireless Controller Firmware"	8.10\(204.92\) Search vendor "Cisco" for product "5520 Wireless Controller Firmware" and version "8.10\(204.92\)"	-	Affected	in	Cisco Search vendor "Cisco"	5520 Wireless Controller Search vendor "Cisco" for product "5520 Wireless Controller"	-	-	Safe