CVE-2018-0412

CWE-3104 documents4 sources

Severity

5.3MEDIUM

EPSS

0.1%

top 77.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Wap121 Firmware Cisco Wap125 Firmware Cisco Wap131 Firmware +7 more

Timeline

PublishedAug 15

Latest updateMay 13

Description

A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an unauthenticated, adjacent attacker to force the downgrade of the encryption algorithm that is used between an authenticator (access point) and a supplicant (Wi-Fi client). The vulnerability is due to the improper processing of certain EAPOL messages that are re…

CVSS vector

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages10 packages

▶CVEListV5cisco_systems,_inc./small_business_100_series_wireless_access_pointsunspecified

▶CVEListV5cisco_systems,_inc./small_business_300_series_wireless_access_pointsunspecified

▶NVDcisco/wap121_firmware1.0.6.6

▶NVDcisco/wap125_firmware1.0.6.6

▶NVDcisco/wap131_firmware1.0.6.6

🔴Vulnerability Details

GHSA

GHSA-c7f3-h262-jxw5: A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless↗2022-05-13

▶

CVEList

CVE-2018-0412: A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless↗2018-08-15

▶

📋Vendor Advisories

Cisco

Cisco Small Business 100 Series and 300 Series Wireless Access Points Encryption Algorithm Downgrade Vulnerability↗2018-08-15

▶