CVE-2018-0416
Cisco Wireless LAN Controller Software Information Disclosure Vulnerability
Published 8 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system information that under normal circumstances should be prohibited. The vulnerability is due to incomplete input and validation checking mechanisms in the web-based interface URL request. An attacker could exploit this vulnerability by requesting specific URLs via the web-based interface. A successful exploit could allow the attacker to view sensitive system information.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
2.51% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Cisco Cisco Wireless LAN Controller (WLC)
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- securitytracker.com /id/1041928 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/105675 · vdb-entry, x_refsource_BID, x_transferred
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-id · vendor-advisory, x_refsource_CISCO, x_transferred
Sources
- CVE List: CVE-2018-0416
- NVD: CVE-2018-0416
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.