cve-2019-15261
Vulnerability from cvelistv5
Published
2019-10-16 18:36
Modified
2024-09-16 17:03
Severity ?
8.6 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability
References
ykramarz@cisco.comhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dosVendor Advisory
Impacted products
CiscoCisco Aironet Access Point Software
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:42:03.792Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20191016 Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Aironet Access Point Software",
          "vendor": "Cisco",
          "versions": [
            {
              "lessThan": "n/a",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2019-10-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Generic Routing Encapsulation (GRE) frames that pass through the data plane of an affected AP. An attacker could exploit this vulnerability by associating to a vulnerable AP, initiating a PPTP VPN connection to an arbitrary PPTP VPN server, and sending a malicious GRE frame through the data plane of the AP. A successful exploit could allow the attacker to cause an internal process of the targeted AP to crash, which in turn would cause the AP to reload. The AP reload would cause a DoS condition for clients that are associated with the AP."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-16T18:36:39",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20191016 Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos"
        }
      ],
      "source": {
        "advisory": "cisco-sa-20191016-airo-pptp-dos",
        "defect": [
          [
            "CSCvk79807"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2019-10-16T16:00:00-0700",
          "ID": "CVE-2019-15261",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Aironet Access Point Software",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Generic Routing Encapsulation (GRE) frames that pass through the data plane of an affected AP. An attacker could exploit this vulnerability by associating to a vulnerable AP, initiating a PPTP VPN connection to an arbitrary PPTP VPN server, and sending a malicious GRE frame through the data plane of the AP. A successful exploit could allow the attacker to cause an internal process of the targeted AP to crash, which in turn would cause the AP to reload. The AP reload would cause a DoS condition for clients that are associated with the AP."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "8.6",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20191016 Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-20191016-airo-pptp-dos",
          "defect": [
            [
              "CSCvk79807"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2019-15261",
    "datePublished": "2019-10-16T18:36:39.319975Z",
    "dateReserved": "2019-08-20T00:00:00",
    "dateUpdated": "2024-09-16T17:03:47.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-15261\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2019-10-16T19:15:13.847\",\"lastModified\":\"2019-10-22T19:51:02.877\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Generic Routing Encapsulation (GRE) frames that pass through the data plane of an affected AP. An attacker could exploit this vulnerability by associating to a vulnerable AP, initiating a PPTP VPN connection to an arbitrary PPTP VPN server, and sending a malicious GRE frame through the data plane of the AP. A successful exploit could allow the attacker to cause an internal process of the targeted AP to crash, which in turn would cause the AP to reload. The AP reload would cause a DoS condition for clients that are associated with the AP.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la funcionalidad de procesamiento de paquetes Point-to-Point Tunneling Protocol (PPTP) VPN en Cisco Aironet Access Points (APs), podr\u00eda permitir a un atacante remoto no autenticado causar la recarga de un dispositivo afectado, resultando en una condici\u00f3n de denegaci\u00f3n de servicio (DoS). La vulnerabilidad es debido a una comprobaci\u00f3n insuficiente de las tramas Generic Routing Encapsulation (GRE) que pasan por medio del plano de datos de un AP afectado. Un atacante podr\u00eda explotar esta vulnerabilidad al asociarse en un AP vulnerable, iniciar una conexi\u00f3n VPN PPTP a un servidor VPN PPTP arbitrario y enviar una trama GRE maliciosa por medio del plano de datos del AP. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante causar que un proceso interno del AP objetivo se bloquee, lo que a su vez causar\u00eda que el AP se recargue. La recarga AP provocar\u00eda una condici\u00f3n DoS para los clientes que est\u00e1n asociados con el AP.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0}],\"cvssMetricV30\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":7.8},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:aironet_1810:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36F923CF-D4EB-48F8-821D-8BB3A69ABB62\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1810_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4\",\"versionEndExcluding\":\"8.5.151.0\",\"matchCriteriaId\":\"A0EB1E05-D03C-419E-A0D7-5C8CC944D38B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1810_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.8\",\"versionEndExcluding\":\"8.8.125.0\",\"matchCriteriaId\":\"1F8A1D80-EF83-42FD-BB13-243EA2049EE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1810_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.9\",\"versionEndExcluding\":\"8.9.111.0\",\"matchCriteriaId\":\"1081F9D9-1B44-47FB-A0D5-3398D2979D50\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:aironet_1830:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"093AB3A8-853B-4094-BFB5-6A8775AAA8D3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1830_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4\",\"versionEndExcluding\":\"8.5.151.0\",\"matchCriteriaId\":\"8D6EA9B7-CB0F-4E9E-A31C-F8F88CB429D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1830_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.8\",\"versionEndExcluding\":\"8.8.125.0\",\"matchCriteriaId\":\"3042B1FA-368C-4340-B058-FF57C225E09A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1830_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.9\",\"versionEndExcluding\":\"8.9.111.0\",\"matchCriteriaId\":\"786B186D-FD13-48A4-AB4E-1BE480465F3C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:aironet_1850:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE0B76A8-377E-4176-8F04-B0D468D4E767\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1850_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4\",\"versionEndExcluding\":\"8.5.151.0\",\"matchCriteriaId\":\"DB295008-4127-477D-B3FD-279F0C168AFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1850_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.8\",\"versionEndExcluding\":\"8.8.125.0\",\"matchCriteriaId\":\"DD7F885D-F60A-4DA9-8023-7A3F3A3F509B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:aironet_1850_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.9\",\"versionEndExcluding\":\"8.9.111.0\",\"matchCriteriaId\":\"155A2052-5460-4ED9-BE28-51453906BE32\"}]}]}],\"references\":[{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos\",\"source\":\"ykramarz@cisco.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.