CVE-2023-20112: cisco business_150ax_firmware Buffer Over-read

Vulnerability summary

CVE-2023-20112 is a high (CVSS 7.4) Buffer Over-read vulnerability in cisco business_150ax_firmware. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities.

Timeline

1. 23-03-2023
   PublishedVulnerability first disclosed.
2. 25-10-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of certain parameters within 802.11 frames. An attacker could exploit this vulnerability by sending a wireless 802.11 association request frame with crafted parameters to an affected device. A successful exploit could allow the attacker to cause an unexpected reload of an affected device, resulting in a DoS condition.

• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.