CVE-2014-0703: cisco wireless_lan_controller_software Race Condition

Vulnerability summary

CVE-2014-0703 is a high (CVSS 10.0) Race Condition vulnerability in cisco wireless_lan_controller_software. EPSS estimates a 2.00% chance of exploitation in the next 30 days, higher than 80.4% of scored vulnerabilities.

Timeline

1. 06-03-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition in the status of the administrative HTTP server, which allows remote attackers to bypass intended access restrictions by connecting to an Aironet access point on which this server had been disabled ineffectively, aka Bug ID CSCuf66202.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.