The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Cisco Wireless Controller

computer vulnerability bulletin CVE-2018-0420

Cisco Wireless LAN Controller: directory traversal via HTTP Request Parameters

Synthesis of the vulnerability

An attacker can traverse directories via HTTP Request Parameters of Cisco Wireless LAN Controller, in order to read a file outside the service root path.
Impacted products: Cisco Wireless Controller.
Severity: 2/4.
Consequences: data reading.
Provenance: user account.
Creation date: 18/10/2018.
Identifiers: CERTFR-2018-AVI-502, cisco-sa-20181017-wlc-traversal, CSCvf66723, CVE-2018-0420, VIGILANCE-VUL-27568.

Description of the vulnerability

An attacker can traverse directories via HTTP Request Parameters of Cisco Wireless LAN Controller, in order to read a file outside the service root path.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2018-0416

Cisco Wireless LAN Controller: information disclosure via Web URL

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via Web URL of Cisco Wireless LAN Controller, in order to obtain sensitive information.
Impacted products: Cisco Wireless Controller.
Severity: 2/4.
Consequences: data reading.
Provenance: radio connection.
Creation date: 18/10/2018.
Identifiers: CERTFR-2018-AVI-502, cisco-sa-20181017-wlc-id, CSCvj95336, CVE-2018-0416, VIGILANCE-VUL-27567.

Description of the vulnerability

An attacker can bypass access restrictions to data via Web URL of Cisco Wireless LAN Controller, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-0417

Cisco Wireless LAN Controller: privilege escalation via TACACS GUI

Synthesis of the vulnerability

An attacker can bypass restrictions via TACACS GUI of Cisco Wireless LAN Controller, in order to escalate his privileges.
Impacted products: Cisco Wireless Controller.
Severity: 2/4.
Consequences: administrator access/rights, privileged access/rights.
Provenance: user account.
Creation date: 18/10/2018.
Identifiers: CERTFR-2018-AVI-502, cisco-sa-20181017-wlc-gui-privesc, CSCvh65876, CVE-2018-0417, VIGILANCE-VUL-27566.

Description of the vulnerability

An attacker can bypass restrictions via TACACS GUI of Cisco Wireless LAN Controller, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2018-0443

Cisco Wireless LAN Controller: denial of service via CAPWAP

Synthesis of the vulnerability

An attacker can generate a fatal error via CAPWAP of Cisco Wireless LAN Controller, in order to trigger a denial of service.
Impacted products: Cisco Wireless Controller.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: radio connection.
Creation date: 18/10/2018.
Identifiers: CERTFR-2018-AVI-502, cisco-sa-20181017-wlc-capwap-dos, CSCvf66696, CVE-2018-0443, VIGILANCE-VUL-27564.

Description of the vulnerability

An attacker can generate a fatal error via CAPWAP of Cisco Wireless LAN Controller, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2018-0388

Cisco Wireless LAN Controller: Cross Site Scripting

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting of Cisco Wireless LAN Controller, in order to run JavaScript code in the context of the web site.
Impacted products: Cisco Wireless Controller.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Creation date: 18/10/2018.
Identifiers: CERTFR-2018-AVI-502, cisco-sa-20181017-wlan-xss, CSCvi97023, CVE-2018-0388, VIGILANCE-VUL-27563.

Description of the vulnerability

The Cisco Wireless LAN Controller product offers a web service.

However, it does not filter received data before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting of Cisco Wireless LAN Controller, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2018-15395

Cisco Wireless LAN Controller: privilege escalation via Cisco TrustSec Domain

Synthesis of the vulnerability

An attacker can bypass restrictions via Cisco TrustSec Domain of Cisco Wireless LAN Controller, in order to escalate his privileges.
Impacted products: Cisco Wireless Controller.
Severity: 2/4.
Consequences: administrator access/rights, privileged access/rights.
Provenance: user account.
Creation date: 18/10/2018.
Identifiers: CERTFR-2018-AVI-502, cisco-sa-20181017-wlan-escalation, CSCvi49059, CVE-2018-15395, VIGILANCE-VUL-27562.

Description of the vulnerability

An attacker can bypass restrictions via Cisco TrustSec Domain of Cisco Wireless LAN Controller, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2018-5391

Linux kernel: denial of service via FragmentSmack

Synthesis of the vulnerability

An attacker can generate a fatal error via FragmentSmack of the Linux kernel, in order to trigger a denial of service.
Impacted products: GAiA, SecurePlatform, CheckPoint Security Gateway, Cisco Aironet, IOS XE Cisco, Nexus by Cisco, Prime Collaboration Assurance, Prime Infrastructure, Cisco Router, Secure ACS, Cisco CUCM, Cisco UCS, Cisco Unified CCX, Cisco IP Phone, Cisco Wireless Controller, Debian, BIG-IP Hardware, TMOS, Junos Space, Linux, Windows 10, Windows 2008 R0, Windows 2008 R2, Windows 2012, Windows 2016, Windows 7, Windows 8, Windows RT, openSUSE Leap, Palo Alto Firewall PA***, PAN-OS, RHEL, SUSE Linux Enterprise Desktop, SLES, Symantec Content Analysis, ProxySG by Symantec, Synology DSM, Ubuntu.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: internet client.
Creation date: 16/08/2018.
Identifiers: ADV180022, CERTFR-2018-AVI-390, CERTFR-2018-AVI-392, CERTFR-2018-AVI-419, CERTFR-2018-AVI-457, CERTFR-2018-AVI-478, CERTFR-2018-AVI-533, CERTFR-2019-AVI-233, cisco-sa-20180824-linux-ip-fragment, CVE-2018-5391, DLA-1466-1, DLA-1529-1, DSA-4272-1, FragmentSmack, JSA10917, K74374841, openSUSE-SU-2018:2404-1, openSUSE-SU-2018:2407-1, openSUSE-SU-2019:0274-1, PAN-SA-2018-0012, RHSA-2018:2785-01, RHSA-2018:2791-01, RHSA-2018:2846-01, RHSA-2018:2924-01, RHSA-2018:2925-01, RHSA-2018:2933-01, RHSA-2018:2948-01, RHSA-2018:3083-01, RHSA-2018:3096-01, RHSA-2018:3459-01, RHSA-2018:3540-01, RHSA-2018:3586-01, RHSA-2018:3590-01, sk134253, SUSE-SU-2018:2344-1, SUSE-SU-2018:2374-1, SUSE-SU-2018:2380-1, SUSE-SU-2018:2381-1, SUSE-SU-2018:2596-1, SUSE-SU-2019:0541-1, SUSE-SU-2019:1289-1, SYMSA1467, Synology-SA-18:44, USN-3740-1, USN-3740-2, USN-3741-1, USN-3741-2, USN-3741-3, USN-3742-1, USN-3742-2, USN-3742-3, VIGILANCE-VUL-27009, VU#641765.

Description of the vulnerability

An attacker can generate a fatal error via FragmentSmack of the Linux kernel, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-0235

Cisco WLC: denial of service via 802.11 Management Frame

Synthesis of the vulnerability

An attacker can send malicious 802.11 Management Frame packets to Cisco WLC, in order to trigger a denial of service.
Impacted products: Cisco Wireless Controller.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: radio connection.
Creation date: 03/05/2018.
Identifiers: CERTFR-2018-AVI-211, cisco-sa-20180502-wlc-mfdos, CSCvg07024, CVE-2018-0235, VIGILANCE-VUL-26036.

Description of the vulnerability

An attacker can send malicious 802.11 Management Frame packets to Cisco WLC, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability CVE-2018-0252

Cisco WLC: denial of service via IP Fragment Reassembly

Synthesis of the vulnerability

An attacker can generate a fatal error via IP Fragment Reassembly of Cisco WLC, in order to trigger a denial of service.
Impacted products: Cisco Wireless Controller.
Severity: 3/4.
Consequences: denial of service on server, denial of service on service.
Provenance: internet client.
Creation date: 03/05/2018.
Identifiers: CERTFR-2018-AVI-211, cisco-sa-20180502-wlc-ip, CSCvf89222, CVE-2018-0252, VIGILANCE-VUL-26035.

Description of the vulnerability

An attacker can generate a fatal error via IP Fragment Reassembly of Cisco WLC, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2018-0245

Cisco WLC: information disclosure via REST API

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via REST API of Cisco WLC, in order to obtain sensitive information.
Impacted products: Cisco Wireless Controller.
Severity: 2/4.
Consequences: data reading.
Provenance: intranet client.
Creation date: 03/05/2018.
Identifiers: CERTFR-2018-AVI-211, cisco-sa-20180502-wlc-id, CSCvg89442, CVE-2018-0245, VIGILANCE-VUL-26034.

Description of the vulnerability

An attacker can bypass access restrictions to data via REST API of Cisco WLC, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Cisco Wireless Controller: