Sign-up

ID

VAR-201805-0494


CVE

CVE-2018-0250


TITLE

Cisco Aironet for FlexConnect Access Points of Central Web Authentication Vulnerability in protection mechanism

Trust: 0.8

sources: JVNDB: JVNDB-2018-004605

DESCRIPTION

A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list (ACL). The vulnerability is due to the AP ignoring the ACL download from the client during authentication. An attacker could exploit this vulnerability by connecting to the targeted device with a vulnerable configuration. A successful exploit could allow the attacker to bypass a configured client FlexConnect ACL. This vulnerability affects the following Cisco products if they are running a vulnerable release of Central Web Authentication with FlexConnect Access Points Software: Aironet 1560 Series Access Points, Aironet 1810 Series OfficeExtend Access Points, Aironet 1810w Series Access Points, Aironet 1815 Series Access Points, Aironet 1830 Series Access Points, Aironet 1850 Series Access Points, Aironet 2800 Series Access Points, Aironet 3800 Series Access Points. Note: Central Web Authentication with FlexConnect Access Points was an unsupported configuration until 8.5.100.0. Cisco Bug IDs: CSCve17756. Vendors have confirmed this vulnerability Bug ID CSCve17756 It is released as.Information may be tampered with. There are security vulnerabilities in CWAs that use APs in several Cisco products

Trust: 2.52

sources: NVD: CVE-2018-0250 // JVNDB: JVNDB-2018-004605 // CNVD: CNVD-2018-14568 // BID: 104248 // VULHUB: VHN-118452

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-14568

AFFECTED PRODUCTS

vendor:ciscomodel:aironet access point softwarescope:eqversion:8.4\(100.0\)

Trust: 1.6

vendor:ciscomodel:aironet access point softwarescope:eqversion:8.7\(1.3\)

Trust: 1.6

vendor:ciscomodel:aironet access point softwarescope:eqversion:8.2\(160.0\)

Trust: 1.6

vendor:ciscomodel:aironet access point softwarescope: - version: -

Trust: 0.8

vendor:ciscomodel:aironet series access pointscope:eqversion:3800

Trust: 0.6

vendor:ciscomodel:aironet series access pointsscope:eqversion:2800

Trust: 0.6

vendor:ciscomodel:aironet series access pointsscope:eqversion:1560

Trust: 0.6

vendor:ciscomodel:aironet series officeextend access pointsscope:eqversion:1810

Trust: 0.6

vendor:ciscomodel:aironet 1810w series access pointsscope: - version: -

Trust: 0.6

vendor:ciscomodel:aironet series access pointsscope:eqversion:1815

Trust: 0.6

vendor:ciscomodel:aironet series access pointsscope:eqversion:1830

Trust: 0.6

vendor:ciscomodel:aironet series access pointsscope:eqversion:1850

Trust: 0.6

vendor:ciscomodel:flexconnect access points softwarescope:eqversion:0

Trust: 0.3

vendor:ciscomodel:aironet series access pointsscope:eqversion:38000

Trust: 0.3

vendor:ciscomodel:aironet series access pointsscope:eqversion:28000

Trust: 0.3

vendor:ciscomodel:aironet series access pointsscope:eqversion:18500

Trust: 0.3

vendor:ciscomodel:aironet series access pointsscope:eqversion:18300

Trust: 0.3

vendor:ciscomodel:aironet series access pointsscope:eqversion:18150

Trust: 0.3

vendor:ciscomodel:aironet 1810w series access pointsscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:aironet series officeextend access pointsscope:eqversion:18100

Trust: 0.3

vendor:ciscomodel:aironet series access pointsscope:eqversion:15600

Trust: 0.3

sources: CNVD: CNVD-2018-14568 // BID: 104248 // JVNDB: JVNDB-2018-004605 // CNNVD: CNNVD-201805-085 // NVD: CVE-2018-0250

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0250
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-0250
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2018-14568
value: LOW

Trust: 0.6

CNNVD: CNNVD-201805-085
value: MEDIUM

Trust: 0.6

VULHUB: VHN-118452
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2018-0250
severity: LOW
baseScore: 2.7
vectorString: AV:A/AC:L/AU:S/C:N/I:P/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 5.1
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-14568
severity: LOW
baseScore: 2.7
vectorString: AV:A/AC:L/AU:S/C:N/I:P/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 5.1
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-118452
severity: LOW
baseScore: 2.7
vectorString: AV:A/AC:L/AU:S/C:N/I:P/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 5.1
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0250
baseSeverity: MEDIUM
baseScore: 4.1
vectorString: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 1.4
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-14568 // VULHUB: VHN-118452 // JVNDB: JVNDB-2018-004605 // CNNVD: CNNVD-201805-085 // NVD: CVE-2018-0250

PROBLEMTYPE DATA

problemtype:CWE-693

Trust: 1.9

sources: VULHUB: VHN-118452 // JVNDB: JVNDB-2018-004605 // NVD: CVE-2018-0250

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201805-085

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201805-085

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-004605

PATCH
title:cisco-sa-20180502-ap-aclurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-ap-acl
Trust: 0.8
title:Multiple Cisco devices CentralWebAuthenticationACL bypass the patch for the vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/136251
Trust: 0.6
title:Multiple Cisco device Central Web Authentication Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79821
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-14568 // 
            
            
            
            JVNDB: JVNDB-2018-004605 // 
            
            
            
            CNNVD: CNNVD-201805-085

EXTERNAL IDS
db:NVDid:CVE-2018-0250
Trust: 3.4
db:SECTRACKid:1040818
Trust: 1.7
db:JVNDBid:JVNDB-2018-004605
Trust: 0.8
db:CNVDid:CNVD-2018-14568
Trust: 0.6
db:CNNVDid:CNNVD-201805-085
Trust: 0.6
db:BIDid:104248
Trust: 0.4
db:VULHUBid:VHN-118452
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-14568 // 
            
            
            
            VULHUB: VHN-118452 // 
            
            
            
            BID: 104248 // 
            
            
            
            JVNDB: JVNDB-2018-004605 // 
            
            
            
            CNNVD: CNNVD-201805-085 // 
            
            
            
            NVD: CVE-2018-0250

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180502-ap-acl
Trust: 2.0
url:http://www.securitytracker.com/id/1040818
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2018-0250
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0250
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-14568 // 
            
            
            
            VULHUB: VHN-118452 // 
            
            
            
            BID: 104248 // 
            
            
            
            JVNDB: JVNDB-2018-004605 // 
            
            
            
            CNNVD: CNNVD-201805-085 // 
            
            
            
            NVD: CVE-2018-0250

CREDITS
Cisco.
Trust: 0.3
sources:
            
            
            BID: 104248

SOURCES
db:CNVDid:CNVD-2018-14568
db:VULHUBid:VHN-118452
db:BIDid:104248
db:JVNDBid:JVNDB-2018-004605
db:CNNVDid:CNNVD-201805-085
db:NVDid:CVE-2018-0250

LAST UPDATE DATE
2024-11-23T22:45:19.496000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-14568date:2018-08-03T00:00:00
db:VULHUBid:VHN-118452date:2019-10-09T00:00:00
db:BIDid:104248date:2018-05-02T00:00:00
db:JVNDBid:JVNDB-2018-004605date:2018-06-25T00:00:00
db:CNNVDid:CNNVD-201805-085date:2019-10-17T00:00:00
db:NVDid:CVE-2018-0250date:2024-11-21T03:37:48.950

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-14568date:2018-08-02T00:00:00
db:VULHUBid:VHN-118452date:2018-05-02T00:00:00
db:BIDid:104248date:2018-05-02T00:00:00
db:JVNDBid:JVNDB-2018-004605date:2018-06-25T00:00:00
db:CNNVDid:CNNVD-201805-085date:2018-05-02T00:00:00
db:NVDid:CVE-2018-0250date:2018-05-02T22:29:00.637