Details of VAR-201401-0580

ID

VAR-201401-0580

TITLE

Cisco Aironet AP SNMP trap leaking WEP key vulnerability

Trust: 0.6

sources: CNVD: CNVD-2003-3512

DESCRIPTION

Cisco Aironet Access Points are wireless access points. A vulnerability exists in Cisco Aironet Access Points running Cisco IOS that could result in the disclosure of WEP key information. When the Cisco Aironet Access Points have the 'snmp-server enable traps wlan-wep' command set, the AP device running Cisco IOS Software sends the WEP key to the SNMP server in clear text. The affected hardware models include the Cisco Aironet 1100, 1200, and 1400 series, which is turned off by default. The Cisco Aironet AP model running VxWorks is not affected by this vulnerability. To determine if an AP is running Cisco IOS software, as long as the telnet AP address is displayed as simple as apl200% instead of a graphical interface, it indicates that the IOS software is running. The issue has been reported to exist if the 'snmp-server enable traps wlan-wep' command has been set

Trust: 1.17

sources: CNVD: CNVD-2003-3512 // BID: 9143 // IVD: 68b72f12-203c-11e6-abef-000c29c66e3d // IVD: 7d70f6f0-463f-11e9-a3c9-000c29342cb1

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.0

sources: IVD: 68b72f12-203c-11e6-abef-000c29c66e3d // IVD: 7d70f6f0-463f-11e9-a3c9-000c29342cb1 // CNVD: CNVD-2003-3512

AFFECTED PRODUCTS

vendor:	no	model:	-	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios 12.2 ja	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios 12.2 ja1	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios 12.2 ja1	scope:	ne	version:	-	Trust: 0.3

sources: CNVD: CNVD-2003-3512 // BID: 9143

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2003-3512
value:	MEDIUM
Trust: 0.6
IVD:	68b72f12-203c-11e6-abef-000c29c66e3d
value:	MEDIUM
Trust: 0.2
IVD:	7d70f6f0-463f-11e9-a3c9-000c29342cb1
value:	MEDIUM
Trust: 0.2

CNVD:	CNVD-2003-3512
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	68b72f12-203c-11e6-abef-000c29c66e3d
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	7d70f6f0-463f-11e9-a3c9-000c29342cb1
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 68b72f12-203c-11e6-abef-000c29c66e3d // IVD: 7d70f6f0-463f-11e9-a3c9-000c29342cb1 // CNVD: CNVD-2003-3512

THREAT TYPE

network

Trust: 0.3

sources: BID: 9143

TYPE

Design Error

Trust: 0.3

sources: BID: 9143

PATCH

title:

\302\240\302\240\302\240\302\240\302\240Cisco Aironet AP SNMP trap leaks patches for WEP key vulnerabilities

url:

https://www.cnvd.org.cn/patchinfo/show/42742

Trust: 0.6

sources: CNVD: CNVD-2003-3512

EXTERNAL IDS

db:	CNVD	id:	CNVD-2003-3512	Trust: 1.0
db:	BID	id:	9143	Trust: 0.9
db:	IVD	id:	68B72F12-203C-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	IVD	id:	7D70F6F0-463F-11E9-A3C9-000C29342CB1	Trust: 0.2

sources: IVD: 68b72f12-203c-11e6-abef-000c29c66e3d // IVD: 7d70f6f0-463f-11e9-a3c9-000c29342cb1 // CNVD: CNVD-2003-3512 // BID: 9143

REFERENCES

url:	http://www.cisco.com/en/us/products/sw/voicesw/ps4625/index.html	Trust: 0.3
url:	http://www.cisco.com/public/sw-center/sw-ios.shtml	Trust: 0.3

sources: BID: 9143

CREDITS

The disclosure of this issue has been credited to Bill Van Devender.

Trust: 0.3

sources: BID: 9143

SOURCES

db:	IVD	id:	68b72f12-203c-11e6-abef-000c29c66e3d
db:	IVD	id:	7d70f6f0-463f-11e9-a3c9-000c29342cb1
db:	CNVD	id:	CNVD-2003-3512
db:	BID	id:	9143

LAST UPDATE DATE

2022-05-17T01:51:11.038000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2003-3512	date:	2014-01-24T00:00:00
db:	BID	id:	9143	date:	2003-12-02T00:00:00

SOURCES RELEASE DATE

db:	IVD	id:	68b72f12-203c-11e6-abef-000c29c66e3d	date:	2014-01-24T00:00:00
db:	IVD	id:	7d70f6f0-463f-11e9-a3c9-000c29342cb1	date:	2014-01-24T00:00:00
db:	CNVD	id:	CNVD-2003-3512	date:	2003-12-02T00:00:00
db:	BID	id:	9143	date:	2003-12-02T00:00:00