var-201711-0310
Vulnerability from variot
A vulnerability in the implementation of Protected Extensible Authentication Protocol (PEAP) functionality for standalone configurations of Cisco Aironet 1800, 2800, and 3800 Series Access Points could allow an unauthenticated, adjacent attacker to bypass authentication and connect to an affected device. The vulnerability exists because the affected device uses an incorrect default configuration setting of fail open when running in standalone mode. An attacker could exploit this vulnerability by attempting to connect to an affected device. A successful exploit could allow the attacker to bypass authentication and connect to the affected device. This vulnerability affects Cisco Aironet 1800, 2800, and 3800 Series Access Points that are running a vulnerable software release and use WLAN configuration settings that include FlexConnect local switching and central authentication with MAC filtering. Cisco Bug IDs: CSCvd46314. Vendors have confirmed this vulnerability Bug ID CSCvd46314 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Cisco Aironet Access Point delivers industry-leading performance for secure, reliable wireless connectivity. Remote users on the local network can exploit the vulnerability to bypass the authentication mechanism and perform unauthorized operations. Cisco Aironet is prone to an authentication-bypass vulnerability. This may lead to further attacks
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201711-0310", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "aironet 3800", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": null }, { "model": "aironet 1800", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": null }, { "model": "aironet 2800", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": null }, { "model": "aironet 1800 series", "scope": null, "trust": 0.8, "vendor": "cisco", "version": null }, { "model": "aironet 2800 series", "scope": null, "trust": 0.8, "vendor": "cisco", "version": null }, { "model": "aironet 3800 series", "scope": null, "trust": 0.8, "vendor": "cisco", "version": null }, { "model": "aironet series access point", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "3800" }, { "model": "aironet series access points", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "1800" }, { "model": "aironet series access points", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "2800" }, { "model": "aironet series access points", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "18008.2(141.0)" }, { "model": "aironet series access points", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "38000" }, { "model": "aironet series access points", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "28000" }, { "model": "aironet series access points", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "18508.2(141.0)" }, { "model": "aironet series access points", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "18000" }, { "model": "aironet series access points", "scope": "ne", "trust": 0.3, "vendor": "cisco", "version": "18508.2(160.0)" }, { "model": "aironet series access points", "scope": "ne", "trust": 0.3, "vendor": "cisco", "version": "18508.2(154.29)" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2017-35878" }, { "db": "BID", "id": "101649" }, { "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "db": "NVD", "id": "CVE-2017-12281" }, { "db": "CNNVD", "id": "CNNVD-201711-072" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:aironet_1800_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:aironet_1830i:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:cisco:aironet_1850i:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:cisco:aironet_1830e:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:cisco:aironet_1850e:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:aironet_2800_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:aironet_2800i:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:cisco:aironet_2800e:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:aironet_3800_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:aironet_3800i:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:cisco:aironet_3800p:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:cisco:aironet_3800e:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2017-12281" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco", "sources": [ { "db": "BID", "id": "101649" } ], "trust": 0.3 }, "cve": "CVE-2017-12281", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "PARTIAL", "baseScore": 5.4, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 5.5, "impactScore": 6.4, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Adjacent Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 5.4, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2017-12281", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "PARTIAL", "baseScore": 5.4, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 5.5, "id": "CNVD-2017-35878", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 5.4, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 5.5, "id": "VHN-102788", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.6, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, { "attackComplexity": "High", "attackVector": "Adjacent Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.5, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2017-12281", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2017-12281", "trust": 1.8, "value": "HIGH" }, { "author": "CNVD", "id": "CNVD-2017-35878", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201711-072", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-102788", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2017-35878" }, { "db": "VULHUB", "id": "VHN-102788" }, { "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "db": "NVD", "id": "CVE-2017-12281" }, { "db": "CNNVD", "id": "CNNVD-201711-072" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability in the implementation of Protected Extensible Authentication Protocol (PEAP) functionality for standalone configurations of Cisco Aironet 1800, 2800, and 3800 Series Access Points could allow an unauthenticated, adjacent attacker to bypass authentication and connect to an affected device. The vulnerability exists because the affected device uses an incorrect default configuration setting of fail open when running in standalone mode. An attacker could exploit this vulnerability by attempting to connect to an affected device. A successful exploit could allow the attacker to bypass authentication and connect to the affected device. This vulnerability affects Cisco Aironet 1800, 2800, and 3800 Series Access Points that are running a vulnerable software release and use WLAN configuration settings that include FlexConnect local switching and central authentication with MAC filtering. Cisco Bug IDs: CSCvd46314. Vendors have confirmed this vulnerability Bug ID CSCvd46314 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Cisco Aironet Access Point delivers industry-leading performance for secure, reliable wireless connectivity. Remote users on the local network can exploit the vulnerability to bypass the authentication mechanism and perform unauthorized operations. Cisco Aironet is prone to an authentication-bypass vulnerability. This may lead to further attacks", "sources": [ { "db": "NVD", "id": "CVE-2017-12281" }, { "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "db": "CNVD", "id": "CNVD-2017-35878" }, { "db": "BID", "id": "101649" }, { "db": "VULHUB", "id": "VHN-102788" } ], "trust": 2.52 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2017-12281", "trust": 3.4 }, { "db": "BID", "id": "101649", "trust": 2.0 }, { "db": "SECTRACK", "id": "1039725", "trust": 1.7 }, { "db": "JVNDB", "id": "JVNDB-2017-009844", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201711-072", "trust": 0.7 }, { "db": "CNVD", "id": "CNVD-2017-35878", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-102788", "trust": 0.1 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2017-35878" }, { "db": "VULHUB", "id": "VHN-102788" }, { "db": "BID", "id": "101649" }, { "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "db": "NVD", "id": "CVE-2017-12281" }, { "db": "CNNVD", "id": "CNNVD-201711-072" } ] }, "id": "VAR-201711-0310", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2017-35878" }, { "db": "VULHUB", "id": "VHN-102788" } ], "trust": 1.16931034 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "Network device" ], "sub_category": null, "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2017-35878" } ] }, "last_update_date": "2023-12-18T13:34:02.684000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "cisco-sa-20171101-aironet3", "trust": 0.8, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20171101-aironet3" }, { "title": "CiscoAironet authentication bypasses the patch for the vulnerability", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/107589" }, { "title": "Cisco Aironet 1800 , 2800 and 3800 Series Access Points Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=76122" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2017-35878" }, { "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "db": "CNNVD", "id": "CNNVD-201711-072" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-287", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-102788" }, { "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "db": "NVD", "id": "CVE-2017-12281" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.6, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20171101-aironet3" }, { "trust": 1.7, "url": "http://www.securityfocus.com/bid/101649" }, { "trust": 1.7, "url": "http://www.securitytracker.com/id/1039725" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12281" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-12281" }, { "trust": 0.3, "url": "http://www.cisco.com/" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2017-35878" }, { "db": "VULHUB", "id": "VHN-102788" }, { "db": "BID", "id": "101649" }, { "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "db": "NVD", "id": "CVE-2017-12281" }, { "db": "CNNVD", "id": "CNNVD-201711-072" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2017-35878" }, { "db": "VULHUB", "id": "VHN-102788" }, { "db": "BID", "id": "101649" }, { "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "db": "NVD", "id": "CVE-2017-12281" }, { "db": "CNNVD", "id": "CNNVD-201711-072" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-12-01T00:00:00", "db": "CNVD", "id": "CNVD-2017-35878" }, { "date": "2017-11-02T00:00:00", "db": "VULHUB", "id": "VHN-102788" }, { "date": "2017-11-01T00:00:00", "db": "BID", "id": "101649" }, { "date": "2017-11-24T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "date": "2017-11-02T16:29:00.613000", "db": "NVD", "id": "CVE-2017-12281" }, { "date": "2017-11-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201711-072" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-12-01T00:00:00", "db": "CNVD", "id": "CNVD-2017-35878" }, { "date": "2019-10-09T00:00:00", "db": "VULHUB", "id": "VHN-102788" }, { "date": "2017-12-19T22:00:00", "db": "BID", "id": "101649" }, { "date": "2017-11-24T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-009844" }, { "date": "2019-10-09T23:22:50.043000", "db": "NVD", "id": "CVE-2017-12281" }, { "date": "2019-10-17T00:00:00", "db": "CNNVD", "id": "CNNVD-201711-072" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote or local", "sources": [ { "db": "CNNVD", "id": "CNNVD-201711-072" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "plural Cisco Aironet Access point authentication vulnerabilities", "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-009844" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "authorization issue", "sources": [ { "db": "CNNVD", "id": "CNNVD-201711-072" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.