CVE-2015-4224
HighSummary
Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the system and potential takeover of the device, posing a serious security threat to the network.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability and restrict CLI access to trusted users.
Other vulnerabilities in Cisco Wireless LAN Controller (WLC)
See all- CVE-2015-0622High
The Wireless Intrusion Detection (WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via crafted packets that are improperly handled during rendering of the Signature Events Summary page.
- CVE-2014-0707High
Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 are vulnerable to an attack that can cause a denial of service by remotely sending a crafted 802.11 Ethernet frame, leading to a device restart.
- CVE-2014-0706High
Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before 7.4.110.0 are vulnerable to an attack that can cause a denial of service through a crafted 802.11 Ethernet frame, leading to a device restart.
- CVE-2014-0705High
The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC) devices in versions 7.2, 7.3, 7.4 before 7.4.121.0, and 7.5, when MLDv2 Snooping is enabled, allows remote attackers to cause a denial of service (device restart) via a malformed IPv6 MLDv2 packet.
- CVE-2014-0703High
Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 have a race condition in the status of the administrative HTTP server, allowing remote attackers to bypass intended access restrictions.
- CVE-2014-0701High
Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, allowing remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate.
- CVE-2015-6314Critical
Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to change configuration settings via unspecified vectors.
Original NVD description (English source)
Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands, aka Bug ID CSCuj39474.