CVE-2018-0248

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) Software versions prior to 8.3.150.0 Cisco Wireless LAN Controller (WLC) Software versions prior to 8.5.140.0 Cisco Wireless LAN Controller (WLC) Software versions prior to 8.8.111.0

Description A vulnerability in the administrative GUI configuration feature of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to cause the device to reload unexpectedly during device configuration, causing a denial of service (DoS) condition on an affected device. The attacker would need to have valid administrator credentials on the device. This vulnerability is due to incomplete input validation for unexpected configuration options that the attacker could submit while accessing the GUI configuration menus. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted user input when using the administrative GUI configuration feature. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Recommendations For versions prior to 8.3.150.0, update to version 8.3.150.0 or later. For versions prior to 8.5.140.0, update to version 8.5.140.0 or later. For versions prior to 8.8.111.0, update to version 8.8.111.0 or later. As a temporary workaround, consider restricting access to the administrative GUI configuration feature until a patch is available.