CSRF in Cisco 2000 Wireless Lan Controller
CVE-2012-5992
Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via screens/aaa/mgmtuser_create.html or (2) insert XSS sequences via the headline parameter to screens/base/web_auth_custom.html, aka Bug ID CSCud50283.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.018 (76.0th percentile) — read the EPSS interpretation.
Affected products
- Cisco 2000_wireless_lan_controller
- Cisco 2100_wireless_lan_controller
- Cisco 2500_wireless_lan_controller
- Cisco 4100_wireless_lan_controller
- Cisco 4400_wireless_lan_controller
- Cisco 5500_wireless_lan_controller
- Cisco 7500_wireless_lan_controller
- Cisco 8500_wireless_lan_controller
- Cisco Wireless_lan_controller_software — versions 7.2.110.0
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@cisco.com (Exploit, x_refsource_MISC)