// For flags

CVE-2023-20251

 

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the memory buffer of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause memory leaks that could eventually lead to a device reboot.
This vulnerability is due to memory leaks caused by multiple clients connecting under specific conditions. An attacker could exploit this vulnerability by causing multiple wireless clients to attempt to connect to an access point (AP) on an affected device. A successful exploit could allow the attacker to cause the affected device to reboot after a significant amount of time, resulting in a denial of service (DoS) condition.

Una vulnerabilidad en el búfer de memoria del software AireOS del Cisco Wireless LAN Controller (WLC) podría permitir que un atacante adyacente no autenticado cause pérdidas de memoria que eventualmente podrían provocar el reinicio del dispositivo. Esta vulnerabilidad se debe a pérdidas de memoria causadas por la conexión de varios clientes en condiciones específicas. Un atacante podría aprovechar esta vulnerabilidad haciendo que varios clientes inalámbricos intenten conectarse a un punto de acceso (AP) en un dispositivo afectado. Un exploit exitoso podría permitir al atacante hacer que el dispositivo afectado se reinicie después de un período de tiempo significativo, lo que resultaría en una condición de denegación de servicio (DoS).

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-10-27 CVE Reserved
  • 2023-09-27 CVE Published
  • 2023-10-07 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Mobility Express Software
Search vendor "Cisco" for product "Mobility Express Software"
--
Affected
in Cisco
Search vendor "Cisco"
 Aireos
Search vendor "Cisco" for product "Aireos"
 >= 8.10.150 < 8.10.190.0
Search vendor "Cisco" for product "Aireos" and version " >= 8.10.150 < 8.10.190.0"
-
Safe