CVE-2018-0443: cisco cisco wireless lan controller (wlc) Resource Management Errors

Vulnerability summary

CVE-2018-0443 is a high (CVSS 8.6) Resource Management Errors vulnerability in cisco cisco wireless lan controller (wlc). EPSS estimates a 3.38% chance of exploitation in the next 30 days, higher than 88.6% of scored vulnerabilities.

Timeline

1. 17-10-2018
   PublishedVulnerability first disclosed.
2. 26-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper input validation on fields within CAPWAP Discovery Request packets by the affected device. An attacker could exploit this vulnerability by sending malicious CAPWAP Discovery Request packets to the Cisco WLC Software. A successful exploit could allow the attacker to cause the Cisco WLC Software to disconnect associated access points (APs). While the APs disconnect and reconnect, service will be unavailable for a brief period of time, resulting in a DoS condition.

• CWE-399Resource Management ErrorsWeaknesses in this category are related to improper management of system resources.
• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.