CVE-2021-34740: cisco aironet_access_point_software

Vulnerability summary

CVE-2021-34740 is a high (CVSS 7.4) vulnerability in cisco aironet_access_point_software. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities.

Timeline

1. 23-09-2021
   PublishedVulnerability first disclosed.
2. 07-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the WLAN Control Protocol (WCP) implementation for Cisco Aironet Access Point (AP) software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect error handling when an affected device receives an unexpected 802.11 frame. An attacker could exploit this vulnerability by sending certain 802.11 frames over the wireless network to an interface on an affected AP. A successful exploit could allow the attacker to cause a packet buffer leak. This could eventually result in buffer allocation failures, which would trigger a reload of the affected device.

• CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.