Cisco on Wednesday informed customers that some of its Aironet access points (APs) are affected by a critical vulnerability that can be exploited by a remote attacker to gain unauthorized access to devices.
The flaw, tracked as CVE-2019-15260, is caused by insufficient access control for some URLs, which allows an attacker to gain access with elevated privileges to the device by requesting the unprotected URLs.
“While the attacker would not be granted access to all possible configuration options, it could allow the attacker to view sensitive information and replace some options with values of their choosing, including wireless network configuration. It would also allow the attacker to disable the AP, creating a denial of service (DoS) condition for clients associated with the AP,” Cisco explained in an advisory.
The vulnerability impacts Aironet 1540, 1560, 1800, 2800, 3800 and 4800 series APs. Patches are included in versions 8.5.151.0, 8.8.125.0 and 8.9.111.0.
Cisco says the vulnerability was discovered during a support case and there is no evidence of exploitation for malicious purposes.
Cisco revealed on Wednesday that Aironet APs are also impacted by two high-severity vulnerabilities that can be exploited without authentication for denial-of-service (DoS) attacks. One of the flaws impacts the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality, while the other exists in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol.
Other high-severity flaws disclosed by Cisco this week include a remote code execution bug in SPA100 series Analog Telephone Adapters, a DoS flaw in Wireless LAN Controller software, and a cross-site request forgery (CSRF) vulnerability in Small Business Smart and Managed switches.
Except for the SPA100 vulnerability, which can be exploited only with authentication, the other weaknesses can be exploited remotely without authentication. The SPA100 security hole has yet to be patched, but Cisco is working on a fix.
Related: Cisco Patches Critical Flaws in Network Switches
Related: Several Vulnerabilities Found in Cisco Industrial Network Director
Related: Cisco UCS Vulnerabilities Allow Complete Takeover of Affected Systems
