CVE-2018-0247

CWE-287 — Improper Authentication4 documents4 sources

Severity

4.7MEDIUM

EPSS

0.3%

top 43.14%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Aironet Access Point Software Cisco Wireless LAN Controller Software

Timeline

PublishedMay 2

Latest updateMay 13

Description

A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic. The vulnerability is due to incorrect implementation of authentication for WebAuth clients in a specific configuration. An attacker could exploit this vulnerability by sending traffic to local network resources without having gone through authentication.…

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5cisco_wireless_lan_controller_and_aironet_access_pointsCisco Wireless LAN Controller and Aironet Access Points

▶NVDcisco/aironet_access_point_software8.3\(104.105\), 8.5\(107.52\)+1

▶NVDcisco/wireless_lan_controller_software8.3\(104.105\)

🔴Vulnerability Details

GHSA

GHSA-f75h-vqxj-crqh: A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Softwa↗2022-05-13

▶

CVEList

CVE-2018-0247: A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Softwa↗2018-05-02

▶

📋Vendor Advisories

Cisco

Cisco Wireless LAN Controller and Aironet Access Points IOS WebAuth Client Authentication Bypass Vulnerability↗2018-05-02

▶