CVE-2015-6311

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0), 7.3(101.0), and 7.4(1.19)

Description The issue is a denial of service vulnerability that could allow an unauthenticated, adjacent attacker to cause a device outage by sending malformed 802.11i management data to a managed access point. This is due to a failure to properly discard certain malformed values in an 802.11i management frame received from a wireless client. To exploit this vulnerability, an attacker must be on the same broadcast or collision domain as the targeted device.

Recommendations For version 7.0(240.0), update to a fixed software version. For version 7.3(101.0), update to a fixed software version. For version 7.4(1.19), update to a fixed software version. As a temporary workaround, consider restricting access to the affected Cisco WLC devices to minimize the risk of exploitation.