Cisco IOS XE up to 16.1 on Catalyst Wireless Controller Manager Request input validation

Summaryinfo

A vulnerability, which was classified as problematic, was found in Cisco IOS XE up to 16.1 on Catalyst. Affected by this vulnerability is an unknown functionality of the component Wireless Controller Manager. Such manipulation as part of Request leads to input validation. This vulnerability is listed as CVE-2017-12222. The attack must be carried out from within the local network. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Cisco IOS XE up to 16.1 on Catalyst (Router Operating System). Affected by this issue is some unknown functionality of the component Wireless Controller Manager. The manipulation as part of a Request leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. CVE summarizes:

A vulnerability in the wireless controller manager of Cisco IOS XE could allow an unauthenticated, adjacent attacker to cause a restart of the switch and result in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted association request. An exploit could allow the attacker to cause the switch to restart. This vulnerability affects Cisco Catalyst 3650 and 3850 switches running IOS XE Software versions 16.1 through 16.3.3, and acting as wireless LAN controllers (WLC). Cisco Bug IDs: CSCvd45069.

The bug was discovered 09/27/2017. The weakness was presented 09/29/2017 (Website). The advisory is shared for download at securitytracker.com. This vulnerability is handled as CVE-2017-12222 since 08/03/2017. The attack can only be initiated within the local network. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 01/14/2021).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316150 (Cisco IOS XE Wireless Controller Manager Denial of Service Vulnerability (cisco-sa-20170927-ios-xe)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 101035†). See VDB-107231, VDB-107232 and VDB-107229 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

Version

• 16.0
• 16.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion