Details of VAR-201808-0300

ID

VAR-201808-0300

CVE

CVE-2018-0415

TITLE

Cisco Small Business 100 Series and Small Business 300 Series wireless access point error handling vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-009157

DESCRIPTION

A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an authenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of certain EAPOL frames. An attacker could exploit this vulnerability by sending a stream of crafted EAPOL frames to an affected device. A successful exploit could allow the attacker to force the access point (AP) to disassociate all the associated stations (STAs) and to disallow future, new association requests. Cisco Bug IDs: CSCvj97472. Vendors have confirmed this vulnerability Bug ID CSCvj97472 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. A denial of service vulnerability exists in the implementation of the ExtensibleAuthenticationProtocoloverLAN (EAPOL) feature in CiscoSmallBusiness100SeriesWirelessAccessPoints and SmallBusiness300SeriesWirelessAccessPoints, which stems from a program not properly processing EAPOL frames. Multiple Cisco Products are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition

Trust: 2.52

sources: NVD: CVE-2018-0415 // JVNDB: JVNDB-2018-009157 // CNVD: CNVD-2018-16178 // BID: 105116 // VULHUB: VHN-118617

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-16178

AFFECTED PRODUCTS

vendor:	cisco	model:	wap121	scope:	lte	version:	1.0.6.6	Trust: 1.0
vendor:	cisco	model:	wap131	scope:	lte	version:	1.0.6.6	Trust: 1.0
vendor:	cisco	model:	wap150	scope:	lte	version:	1.0.6.6	Trust: 1.0
vendor:	cisco	model:	wap361	scope:	lte	version:	1.0.6.6	Trust: 1.0
vendor:	cisco	model:	wap125	scope:	lte	version:	1.0.6.6	Trust: 1.0
vendor:	cisco	model:	wap321	scope:	lte	version:	1.0.6.6	Trust: 1.0
vendor:	cisco	model:	wap371	scope:	lte	version:	1.0.6.6	Trust: 1.0
vendor:	cisco	model:	wap351	scope:	lte	version:	1.0.6.6	Trust: 1.0
vendor:	cisco	model:	wap121	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	wap125	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	wap131	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	wap150	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	wap321	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	wap351	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	wap361	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	wap371	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	small business series wireless access points	scope:	eq	version:	100	Trust: 0.6
vendor:	cisco	model:	small business series wireless access points	scope:	eq	version:	300	Trust: 0.6
vendor:	cisco	model:	wap125	scope:	eq	version:	1.0.6.6	Trust: 0.6
vendor:	cisco	model:	wap121	scope:	eq	version:	1.0.6.6	Trust: 0.6
vendor:	cisco	model:	wap131	scope:	eq	version:	1.0.6.6	Trust: 0.6
vendor:	cisco	model:	wap361	scope:	eq	version:	1.0.6.6	Trust: 0.6
vendor:	cisco	model:	wap150	scope:	eq	version:	1.0.6.6	Trust: 0.6
vendor:	cisco	model:	wap371	scope:	eq	version:	1.0.6.6	Trust: 0.6
vendor:	cisco	model:	wap351	scope:	eq	version:	1.0.6.6	Trust: 0.6
vendor:	cisco	model:	wap321	scope:	eq	version:	1.0.6.6	Trust: 0.6
vendor:	cisco	model:	small business series wireless access points	scope:	eq	version:	3000	Trust: 0.3
vendor:	cisco	model:	small business series wireless access points	scope:	eq	version:	1000	Trust: 0.3

sources: CNVD: CNVD-2018-16178 // BID: 105116 // JVNDB: JVNDB-2018-009157 // CNNVD: CNNVD-201808-459 // NVD: CVE-2018-0415

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0415
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-0415
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2018-16178
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201808-459
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-118617
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-0415
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:A/AC:L/AU:S/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	5.1
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-16178
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-118617
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:A/AC:L/AU:S/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	5.1
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0415
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.3
impactScore:	4.0
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2018-16178 // VULHUB: VHN-118617 // JVNDB: JVNDB-2018-009157 // CNNVD: CNNVD-201808-459 // NVD: CVE-2018-0415

PROBLEMTYPE DATA

problemtype:

CWE-388

Trust: 1.9

sources: VULHUB: VHN-118617 // JVNDB: JVNDB-2018-009157 // NVD: CVE-2018-0415

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201808-459

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201808-459

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-009157

PATCH

title:	cisco-sa-20180815-csb-wap-dos	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-csb-wap-dos	Trust: 0.8
title:	Patch for CiscoSmallBusiness100SeriesWirelessAccessPoints and SmallBusiness300SeriesWirelessAccessPoints Denial of Service Vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/138281	Trust: 0.6
title:	Cisco Small Business 100 Series Wireless Access Points and Small Business 300 Series Wireless Access Points Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83759	Trust: 0.6

sources: CNVD: CNVD-2018-16178 // JVNDB: JVNDB-2018-009157 // CNNVD: CNNVD-201808-459

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0415	Trust: 3.4
db:	BID	id:	105116	Trust: 2.6
db:	JVNDB	id:	JVNDB-2018-009157	Trust: 0.8
db:	CNNVD	id:	CNNVD-201808-459	Trust: 0.7
db:	CNVD	id:	CNVD-2018-16178	Trust: 0.6
db:	VULHUB	id:	VHN-118617	Trust: 0.1

sources: CNVD: CNVD-2018-16178 // VULHUB: VHN-118617 // BID: 105116 // JVNDB: JVNDB-2018-009157 // CNNVD: CNNVD-201808-459 // NVD: CVE-2018-0415

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180815-csb-wap-dos	Trust: 2.0
url:	http://www.securityfocus.com/bid/105116	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0415	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0415	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2018-16178 // VULHUB: VHN-118617 // BID: 105116 // JVNDB: JVNDB-2018-009157 // CNNVD: CNNVD-201808-459 // NVD: CVE-2018-0415

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 105116

SOURCES

db:	CNVD	id:	CNVD-2018-16178
db:	VULHUB	id:	VHN-118617
db:	BID	id:	105116
db:	JVNDB	id:	JVNDB-2018-009157
db:	CNNVD	id:	CNNVD-201808-459
db:	NVD	id:	CVE-2018-0415

LAST UPDATE DATE

2024-11-23T22:48:35.859000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-16178	date:	2018-08-25T00:00:00
db:	VULHUB	id:	VHN-118617	date:	2019-10-09T00:00:00
db:	BID	id:	105116	date:	2018-08-15T00:00:00
db:	JVNDB	id:	JVNDB-2018-009157	date:	2018-11-09T00:00:00
db:	CNNVD	id:	CNNVD-201808-459	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0415	date:	2024-11-21T03:38:10.883

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-16178	date:	2018-08-24T00:00:00
db:	VULHUB	id:	VHN-118617	date:	2018-08-15T00:00:00
db:	BID	id:	105116	date:	2018-08-15T00:00:00
db:	JVNDB	id:	JVNDB-2018-009157	date:	2018-11-09T00:00:00
db:	CNNVD	id:	CNNVD-201808-459	date:	2018-08-16T00:00:00
db:	NVD	id:	CVE-2018-0415	date:	2018-08-15T20:29:00.893