SQL Injection in Cisco Wireless Control System Software

CVE-2010-2826

SQL injection vulnerability in Cisco Wireless Control System (WCS) 6.0.x before 6.0.196.0 allows remote authenticated users to execute arbitrary SQL commands via vectors related to the ORDER BY clause of the Client List screens, aka Bug ID CSCtf37019.

Vulnerability class: SQL Injection

EPSS: 0.013 (69.3th percentile) — read the EPSS interpretation.

Affected products

Cisco Wireless_control_system_software — versions 6.0.132.0, 6.0.181.0, 6.0.182.0
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)