{
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "A configuration option for the Splash Page feature (also known as Captive Portal) in Cisco Meraki MR Series devices may allow an administrator to configure an 802.11 WLAN in which traffic policies are not applied to clients that are connecting to the network.\r\n\r\nThe insecure configuration is determined when an administrator configures a WLAN with Splash Page access control and Captive Portal strength is set to Allow non-HTTP traffic prior to sign-on.\r\n\r\nWhile this setup is intended to provide wireless clients with connectivity before they interact with the Splash Page, traffic policies are applied only after the sign on is completed. A malicious user could take advantage of this insecure configuration to circumvent network policies such as firewall rules, content filtering, and traffic shaping that is configured to restrict traffic within the impacted WLAN.\r\n\r\nCisco Meraki does not consider this to be a vulnerability in Cisco Meraki MR Software or in the Splash Page feature. It is considered a configuration issue.\r\n\r\nFor more robust network security, Cisco Meraki recommends following the guidance in the Recommendations [\"#rec\"] section of this advisory to make any appropriate configuration changes.\r\n\r\nNote: The option is disabled by default on WLANs that were created through the Cisco Meraki Cloud Management Interface (also known as Dashboard) after December 4, 2020.\r\n\r\nThis advisory is available at the following link:\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-config-Ab3Da [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-config-Ab3Da\"]",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "At the time of publication, this issue affected Cisco Meraki MR Series devices if they were configured with a WLAN that uses a Splash Page for access control, and Captive portal strength is set to Allow non-HTTP traffic prior to sign-on.\r\n Determine Whether a Device is Affected\r\nTo determine whether a device is affected by the issue that is described in this advisory, complete the following steps:\r\n\r\nStep 1: Determine whether a Splash Page is configured\r\n\r\nLog in to the Dashboard.\r\nChoose Wireless \u003e Configure \u003e Access control in the Combined view.\r\nChoose the appropriate WLAN from the SSID drop-down menu.\r\nLocate and expand the Splash Page section.\r\n\r\nIf Splash Page type is set to any value other than None (direct access), then the WLAN was configured to use a Splash Page for access control. Continue to Step 2.\r\n\r\nIf Splash Page type is set to None (direct access) or if the Advanced splash settings section cannot be expanded, then the WLAN is not configured to use a Splash Page for access control and is not susceptible to the issue that is described in this advisory.\r\n\r\nStep 2: Determine the Captive Portal strength settings\r\n\r\nFrom the Splash Page section, click Advanced splash settings to expand the Configuration section.\r\nLocate the Captive portal strength drop-down menu.\r\n\r\nIf Captive portal strength is set to Allow non-HTTP traffic prior to sign-on, then the WLAN is configured with the insecure configuration option that is described in this advisory.\r\n\r\nIf Captive portal strength is set to Block all access until sign-on is complete, then the WLAN is not configured with the insecure configuration option and it is not susceptible to the issue that is described in this advisory.\r\n\r\nOn a Cisco Meraki MR device, a separate Splash Page can be configured for each WLAN in use. Each Splash Page has specific Captive Portal strength settings. Cisco Meraki recommends reviewing the configuration of each WLAN that is enabled on the device, as indicated in the Recommendations [\"#rec\"] section of this advisory.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "The target audience of this informational advisory is those customers who have deployed WLAN networks using a Splash Page for access control.\r\n\r\nThe Cisco Meraki Splash Page is a web-based access control feature that requires users to view and interact with an HTML page before gaining full network access. The scope of network access that a client has before interacting with the Splash Page is restricted through the Captive portal strength settings. When Captive portal strength is set to Allow non-HTTP traffic prior to sign-on, network connectivity is provided to wireless clients before they interact with the Splash Page, with the exception of traffic that is destined for TCP Port 80.\r\n\r\nOn Cisco Meraki MR Series devices, Captive portal strength settings take precedence over configured traffic shaping, content filtering, and firewall rules when the Splash Page is configured. The user-defined WLAN traffic policies will be applied after the sign on is completed.\r\n\r\nFor more information about the Cisco Meraki Splash Page, see Splash Page [\"https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Splash_Page\"].",
        "title": "Details"
      },
      {
        "category": "general",
        "text": "Cisco Meraki recommends reviewing the configuration of each WLAN in use. In a WLAN deployment where access is controlled through the Splash Page, Cisco Meraki recommends setting the Captive portal strength to Block all access until sign-on is complete.\r\n\r\nTo adopt a more secure setup complete the following steps:\r\n\r\nLog in to the Dashboard.\r\nChoose Wireless \u003e Configure \u003e Access control in the Combined view.\r\nChoose the appropriate WLAN from the SSID drop-down menu.\r\nLocate the Splash Page section.\r\nClick Advanced splash settings to expand the Configuration section.\r\nFrom the Captive portal strength drop-down menu, choose Block all access until sign-on is complete if is it not already chosen.\r\n\r\nIf the Advanced splash settings section cannot be expanded, then the WLAN is not configured to use a Splash Page for access control and is not susceptible to the issue that is described in this advisory.\r\n\r\nIf Captive portal strength is set to Block all access until sign-on is complete, then the WLAN is not susceptible to the issue that is described in this advisory.",
        "title": "Recommendations"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
      "issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco Meraki MR Series Splash Page Insecure Configuration Option",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-config-Ab3Da"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-config-Ab3Da",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-config-Ab3Da"
      },
      {
        "category": "external",
        "summary": "Splash Page",
        "url": "https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Splash_Page"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      }
    ],
    "title": "Cisco Meraki MR Series Splash Page Insecure Configuration Option",
    "tracking": {
      "current_release_date": "2022-09-07T16:00:00+00:00",
      "generator": {
        "date": "2022-09-07T15:47:15+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-meraki-config-Ab3Da",
      "initial_release_date": "2022-09-07T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2022-09-07T15:47:09+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  }
}