Auth bypass in Cisco Aironet_access_point_software
CVE-2018-0247
A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass tr…
Vulnerability class: Broken Authentication
EPSS: 0.009 (56.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N.
Affected products
- Cisco Aironet_access_point_software — versions 8.3\(104.105\), 8.5\(107.52\)
- Cisco Wireless_lan_controller_software — versions 8.3\(104.105\)
- N/a Cisco Wireless Lan Controller And Aironet Access Points — versions Cisco Wireless LAN Controller and Aironet Access Points
Weakness classification (CWE)
References
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2018-0247?
- CVE-2018-0247 is a medium-severity vulnerability in Cisco Aironet_access_point_software, classified under Improper Authentication. CVSS score: 4.7/10. Published 2018-05-02.
- How severe is CVE-2018-0247?
- Medium severity. CVSS v3 base score is 4.7 out of 10.