Vulnerability Details : CVE-2018-0248
A vulnerability in the administrative GUI configuration feature of Cisco Wireless LAN Controller (WLC) Software could allow an aUTHENTICated, remote attacker to cause the device to reload unexpectedly during device configuration when the administrator is using this GUI, causing a denial of service (DoS) condition on an affected device. The attacker would need to have valid administrator credentials on the device. This vulnerability is due to incomplete input validation for unexpected configuration options that the attacker could submit while accessing the GUI configuration menus. An attacker could exploit these vulnerabilities by authenticating to the device and submitting crafted user input when using the administrative GUI configuration feature. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Software versions prior to 8.3.150.0, 8.5.140.0, 8.8.111.0 are affected by this vulnerability.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2018-0248
- cpe:2.3:a:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-0248
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 44 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-0248
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:C |
8.0
|
6.9
|
NIST | |
4.9
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
1.2
|
3.6
|
NIST | |
6.8
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H |
2.3
|
4.0
|
Cisco Systems, Inc. |
CWE ids for CVE-2018-0248
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2018-0248
-
http://www.securityfocus.com/bid/108009
Cisco Wireless LAN Controller CVE-2018-0248 Multiple Denial of Service VulnerabilitiesVDB Entry;Third Party Advisory
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-gui
Cisco Wireless LAN Controller Software GUI Configuration Denial of Service VulnerabilitiesVendor Advisory
Jump to