Buffer overflow in Cisco 2504 Wireless Lan Controller
CVE-2022-20769
A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error validation. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to cause the wireless LAN controller to crash, resulting in a DoS condition. Note: This vulnerability affects only devices that have Federal Information Processing Standards (FIPS) mode enabled.
Vulnerability class: Buffer Overflow
EPSS: 0.005 (40.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
Affected products
- Cisco 2504_wireless_lan_controller
- Cisco 3504_wireless_lan_controller
- Cisco 5508_wireless_lan_controller
- Cisco 5520_wireless_lan_controller
- Cisco 8540_wireless_lan_controller
- Cisco Wireless Lan Controller (Wlc) — versions n/a
- Cisco Flex_7510
- Cisco Virtual_wireless_controller
- Cisco Wireless_lan_controller_software
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-20769?
- CVE-2022-20769 is a high-severity vulnerability in Cisco 2504 Wireless Lan Controller, classified under Out-of-bounds Write. CVSS score: 7.4/10. Published 2022-09-30.
- How severe is CVE-2022-20769?
- High severity. CVSS v3 base score is 7.4 out of 10.
- Is CVE-2022-20769 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.