Cisco Small Business 100 Series Wireless Access Point EAPOL cryptographic issue

Summaryinfo

A vulnerability was found in Cisco Small Business 100 Series Wireless Access Point and Cisco Small Business 300 Series Wireless Access Point. It has been declared as critical. This issue affects some unknown processing of the component EAPOL. The manipulation results in cryptographic issue. This vulnerability is known as CVE-2018-0412. Access to the local network is required for this attack. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in Cisco Small Business 100 Series Wireless Access Point and Cisco Small Business 300 Series Wireless Access Point (Wireless LAN Software) (version now known). Affected is some unknown processing of the component EAPOL. The manipulation with an unknown input leads to a cryptographic issue vulnerability. CWE is classifying the issue as CWE-310. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an unauthenticated, adjacent attacker to force the downgrade of the encryption algorithm that is used between an authenticator (access point) and a supplicant (Wi-Fi client). The vulnerability is due to the improper processing of certain EAPOL messages that are received during the Wi-Fi handshake process. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between a supplicant and an authenticator and manipulating an EAPOL message exchange to force usage of a WPA-TKIP cipher instead of the more secure AES-CCMP cipher. A successful exploit could allow the attacker to conduct subsequent cryptographic attacks, which could lead to the disclosure of confidential information. Cisco Bug IDs: CSCvj29229.

The bug was discovered 08/15/2018. The weakness was published 08/15/2018 as cisco-sa-20180815-sb-wap-encry as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2018-0412 since 11/26/2017. Access to the local network is required for this attack to succeed. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/16/2020). The MITRE ATT&CK project declares the attack technique as T1600.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-122941. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Cisco

Name

• Cisco Small Business 300 Series Wireless Access Point
• Small Business 100 Series Wireless Access Point

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion