Details of VAR-201810-0296

ID

VAR-201810-0296

CVE

CVE-2018-0416

TITLE

Cisco Wireless LAN Controller Software input validation vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2018-014072 // CNNVD: CNNVD-201810-998

DESCRIPTION

A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system information that under normal circumstances should be prohibited. The vulnerability is due to incomplete input and validation checking mechanisms in the web-based interface URL request. An attacker could exploit this vulnerability by requesting specific URLs via the web-based interface. A successful exploit could allow the attacker to view sensitive system information. The product provides security policy, intrusion detection and other functions in the wireless LAN. This issue is being tracked by Cisco bug ID CSCvj95336. The following products are affected: Cisco Physical wireless LAN controllers; Virtual wireless LAN controllers; 802.11ac Wave2 access points (running in Mobility Express mode and configured as a wireless network manager)

Trust: 2.52

sources: NVD: CVE-2018-0416 // JVNDB: JVNDB-2018-014072 // CNVD: CNVD-2018-21193 // BID: 105675 // VULHUB: VHN-118618

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-21193

AFFECTED PRODUCTS

vendor:	cisco	model:	wireless lan controller software	scope:	eq	version:	8.9\(1.52\)	Trust: 1.0
vendor:	cisco	model:	wireless lan controller software	scope:	eq	version:	8.5\(130.0\)	Trust: 1.0
vendor:	cisco	model:	wireless lan controller software	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	physical wireless lan controllers	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	virtual wireless lan controllers	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	mobility express mode and configured as a wireless lan controller 802.11ac wave2 access points	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	wireless lan controller software	scope:	eq	version:	-	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	eq	version:	55008.9(1.52)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	eq	version:	55008.5(130.0)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.9(1.65)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.8(100.0)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.8(1.176)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.5(137.11)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.5(135.0)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.5(134.102)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.5(131.8)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.5(124.106)	Trust: 0.3

sources: CNVD: CNVD-2018-21193 // BID: 105675 // JVNDB: JVNDB-2018-014072 // NVD: CVE-2018-0416

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0416
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2018-0416
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-0416
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2018-21193
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201810-998
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-118618
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-0416
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-21193
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-118618
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0416
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.0
Trust: 2.8

sources: CNVD: CNVD-2018-21193 // VULHUB: VHN-118618 // JVNDB: JVNDB-2018-014072 // CNNVD: CNNVD-201810-998 // NVD: CVE-2018-0416 // NVD: CVE-2018-0416

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-118618 // JVNDB: JVNDB-2018-014072 // NVD: CVE-2018-0416

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-998

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201810-998

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-014072

PATCH

title:	cisco-sa-20181017-wlc-id	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-id	Trust: 0.8
title:	Cisco Wireless LAN Controller Software Enter the fix for the verification vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86067	Trust: 0.6

sources: JVNDB: JVNDB-2018-014072 // CNNVD: CNNVD-201810-998

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0416	Trust: 3.4
db:	BID	id:	105675	Trust: 2.0
db:	SECTRACK	id:	1041928	Trust: 1.7
db:	JVNDB	id:	JVNDB-2018-014072	Trust: 0.8
db:	CNNVD	id:	CNNVD-201810-998	Trust: 0.7
db:	CNVD	id:	CNVD-2018-21193	Trust: 0.6
db:	VULHUB	id:	VHN-118618	Trust: 0.1

sources: CNVD: CNVD-2018-21193 // VULHUB: VHN-118618 // BID: 105675 // JVNDB: JVNDB-2018-014072 // CNNVD: CNNVD-201810-998 // NVD: CVE-2018-0416

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20181017-wlc-id	Trust: 2.6
url:	http://www.securityfocus.com/bid/105675	Trust: 1.7
url:	http://www.securitytracker.com/id/1041928	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0416	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0416	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2018-21193 // VULHUB: VHN-118618 // BID: 105675 // JVNDB: JVNDB-2018-014072 // CNNVD: CNNVD-201810-998 // NVD: CVE-2018-0416

CREDITS

Cisco

Trust: 0.3

sources: BID: 105675

SOURCES

db:	CNVD	id:	CNVD-2018-21193
db:	VULHUB	id:	VHN-118618
db:	BID	id:	105675
db:	JVNDB	id:	JVNDB-2018-014072
db:	CNNVD	id:	CNNVD-201810-998
db:	NVD	id:	CVE-2018-0416

LAST UPDATE DATE

2024-11-23T22:58:50.523000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-21193	date:	2018-10-18T00:00:00
db:	VULHUB	id:	VHN-118618	date:	2019-10-09T00:00:00
db:	BID	id:	105675	date:	2018-10-17T00:00:00
db:	JVNDB	id:	JVNDB-2018-014072	date:	2019-03-11T00:00:00
db:	CNNVD	id:	CNNVD-201810-998	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0416	date:	2024-11-21T03:38:11.010

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-21193	date:	2018-10-18T00:00:00
db:	VULHUB	id:	VHN-118618	date:	2018-10-17T00:00:00
db:	BID	id:	105675	date:	2018-10-17T00:00:00
db:	JVNDB	id:	JVNDB-2018-014072	date:	2019-03-11T00:00:00
db:	CNNVD	id:	CNNVD-201810-998	date:	2018-10-18T00:00:00
db:	NVD	id:	CVE-2018-0416	date:	2018-10-17T19:29:00.380