Description

A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic. The vulnerability is due to incorrect implementation of authentication for WebAuth clients in a specific configuration. An attacker could exploit this vulnerability by sending traffic to local network resources without having gone through authentication. A successful exploit could allow the attacker to bypass authentication and pass traffic. This affects Cisco Aironet Access Points running Cisco IOS Software and Cisco Wireless LAN Controller (WLC) releases prior to 8.5.110.0 for the following specific WLC configuration only: (1) The Access Point (AP) is configured in FlexConnect Mode with NAT. (2) The WLAN is configured for central switching, meaning the client is being assigned a unique IP address. (3) The AP is configured with a Split Tunnel access control list (ACL) for access to local network resources, meaning the AP is doing the NAT on the connection. (4) The client is using WebAuth. This vulnerability does not apply to .1x clients in the same configuration. Cisco Bug IDs: CSCvc79502, CSCvf71789.

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  4.7 MEDIUM

Vector:  CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score:  3.3 LOW

Vector:  (AV:A/AC:L/Au:N/C:N/I:P/A:N)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://www.securityfocus.com/bid/104087	Third Party Advisory  VDB Entry
http://www.securitytracker.com/id/1040814	Third Party Advisory  VDB Entry
http://www.securitytracker.com/id/1040815	Third Party Advisory  VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-aironet-auth	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-287	Improper Authentication	NIST   Cisco Systems, Inc.

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

5 change records found show changes

CVE Modified by Cisco Systems, Inc. 5/14/2024 12:50:38 AM

Action	Type	Old Value	New Value

CVE Modified by Cisco Systems, Inc. 10/09/2019 7:31:34 PM

Action	Type	Old Value	New Value
Added	CWE		Cisco Systems, Inc. CWE-287

Initial Analysis by NIST 6/13/2018 8:46:01 AM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR *cpe:2.3:o:cisco:aironet_access_point_software:8.3\(104.105\):*:*:*:*:*:*:* *cpe:2.3:o:cisco:aironet_access_point_software:8.5\(107.52\):*:*:*:*:*:*:*
Added	CPE Configuration		OR *cpe:2.3:o:cisco:wireless_lan_controller_software:8.3\(104.105\):*:*:*:*:*:*:*
Added	CVSS V2		(AV:A/AC:L/Au:N/C:N/I:P/A:N)
Added	CVSS V3		AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Added	CWE		CWE-287
Changed	Reference Type	http://www.securityfocus.com/bid/104087 No Types Assigned	http://www.securityfocus.com/bid/104087 Third Party Advisory, VDB Entry
Changed	Reference Type	http://www.securitytracker.com/id/1040814 No Types Assigned	http://www.securitytracker.com/id/1040814 Third Party Advisory, VDB Entry
Changed	Reference Type	http://www.securitytracker.com/id/1040815 No Types Assigned	http://www.securitytracker.com/id/1040815 Third Party Advisory, VDB Entry
Changed	Reference Type	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-aironet-auth No Types Assigned	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-aironet-auth Vendor Advisory

CVE Modified by Cisco Systems, Inc. 5/08/2018 9:29:01 AM

Action	Type	Old Value	New Value
Added	Reference		http://www.securityfocus.com/bid/104087 [No Types Assigned]

CVE Modified by Cisco Systems, Inc. 5/04/2018 9:29:01 PM

Action	Type	Old Value	New Value
Added	Reference		http://www.securitytracker.com/id/1040814 [No Types Assigned]
Added	Reference		http://www.securitytracker.com/id/1040815 [No Types Assigned]