CVE-2014-0703
HighSummary
Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 have a race condition in the status of the administrative HTTP server, allowing remote attackers to bypass intended access restrictions.
Risk Assessment
Attackers may gain unauthorized access to Aironet access points, potentially compromising network security.
Recommendation
It is recommended to update devices to version 7.4.110.0 or later to mitigate this vulnerability.
Other vulnerabilities in Cisco Wireless LAN Controller (WLC)
See all- CVE-2015-4224High
Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands.
- CVE-2015-0622High
The Wireless Intrusion Detection (WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via crafted packets that are improperly handled during rendering of the Signature Events Summary page.
- CVE-2014-0707High
Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 are vulnerable to an attack that can cause a denial of service by remotely sending a crafted 802.11 Ethernet frame, leading to a device restart.
- CVE-2014-0706High
Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before 7.4.110.0 are vulnerable to an attack that can cause a denial of service through a crafted 802.11 Ethernet frame, leading to a device restart.
- CVE-2014-0705High
The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC) devices in versions 7.2, 7.3, 7.4 before 7.4.121.0, and 7.5, when MLDv2 Snooping is enabled, allows remote attackers to cause a denial of service (device restart) via a malformed IPv6 MLDv2 packet.
- CVE-2014-0701High
Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, allowing remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate.
- CVE-2015-6314Critical
Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to change configuration settings via unspecified vectors.
Original NVD description (English source)
Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the administrative HTTP server, which allows remote attackers to bypass intended access restrictions by connecting to an Aironet access point on which this server had been disabled ineffectively, aka Bug ID CSCuf66202.