Cisco Enterprise Wireless (Wi-Fi) Equipment DoS Vulnerability Discovered


If your organisation is using any kind of Cisco Wi-Fi kit it may be time to get the latest patches for your kit. Although they state there is no proof that hackers have used this attack in the wild – in my experience if Cisco have discovered this now, someone else probably knew about it earlier.

There are multiple vulnerabilities mostly concerning malformed packets sent to the web authentication interface which can cause a reload or hanging of the hardware device.

Cisco is urging admins to update their wireless LAN hardware following the discovery of multiple vulnerabilities in its enterprise Wi-Fi kit.

Security flaws in Cisco Wireless LAN Controllers, Cisco Catalyst 6500 Wireless Services Modules (WiSMs), and Cisco Catalyst 3750 Integrated Wireless LAN Controllers create a mechanism for hackers to knock over vulnerable hardware.

All Cisco Wireless LAN Controllers running version 4.2 of the network giant’s software are affected by a pair of denial of service flaws. A third DoS flaw affects software versions 4.1 and later.

The denial of service bugs include a flaw in the handling of Web authentication, which can cause an affected device to reload, and a separate flaw (that also affects version 4.1 of the software) that means vulnerable kit can freeze up on receipt of malformed data packets.

Even if you have recent software (version 4.1) it’s also vulnerable to a separate flaw, which also needs to be patched. I’d imagine now the news is out, even if no one had discovered this previously a little bit of reverse engineering with yield some proof or concept or even a working exploit for these flaws.

You need to check your model numbers though as not all wireless devices are affected.

The same set of potential problems affects Cisco Catalyst 6500 Series/7600 Series Wireless Services Module and Cisco Catalyst 3750 Series Integrated Wireless LAN Controllers but not the equivalent wireless modules on Cisco 2800 and 3800 series Integrated Services Routers. Cisco 2000 and 2100 Series Wireless LAN Controllers are also unaffected by the vulnerability.

The denial of service problem is not the only issue to consider. Version 4.2.173.0 of Cisco’s Wireless LAN controller software is affected by a privilege escalation vulnerability. The security bug creates a means for an ordinary user to gain full administrative rights.

“Successful exploitation of the denial of service vulnerabilities may cause the affected device to hang or reload,” a security advisory from Cisco explains. “Repeated exploitation could result in a sustained DoS condition. The privilege escalation vulnerability may allow an authenticated user to obtain full administrative rights on the affected system.”

One of the flaws is a little more serious resulting in privilege escalation, the end result being administrative access. It does say though you need to be an authenticated user to achieve this – but as they say the majority of attacks come from within an organisation anyway.

As always be wary, and keep your patches up to date. A lot of organisations I’ve audited are very good on patching software, their antivirus is updated daily, Windows updates are applied regularly but often I’ve found hardware and especially Cisco devices woefully out of date.

The problem was discussed here a while ago with the Cisco Vulnerability Given ‘Write Once, Run Anywhere’ Treatement. Cisco needs to make it easier and more efficient for people to update their devices.

Source: The Register

Posted in: Exploits/Vulnerabilities, Hardware Hacking, Networking Hacking

, , , ,


Latest Posts:


SecLists - Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.


One Response to Cisco Enterprise Wireless (Wi-Fi) Equipment DoS Vulnerability Discovered

  1. cbrp1r8 February 9, 2009 at 2:35 pm #

    “my experience if Cisco have discovered this now, someone else probably knew about it earlier.”

    You can take that to the bank! :D