CVE-2012-5991 Denial of service in n/a
Remote authenticated users can cause a denial of service on Cisco Wireless LAN Controllers by sending a specific request to the web authentication interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-5991?
CVE-2012-5991 is a medium-severity denial of service vulnerability in Cisco Wireless Lan Controller Software, published on 19 Dec 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to cause a denial of service (device reload) via a certain buttonClicked value in an internal webauth_type request, aka Bug ID CSCud50209.
Which versions are affected by CVE-2012-5991?
It affects 9 products.
Products include Cisco 2000 Wireless Lan Controller, Cisco 2100 Wireless Lan Controller, Cisco 2500 Wireless Lan Controller, Cisco 4100 Wireless Lan Controller, Cisco 4400 Wireless Lan Controller, Cisco 5500 Wireless Lan Controller and 3 more.
How do I fix CVE-2012-5991?
No fix has been published for CVE-2012-5991 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2012-5991 being exploited?
There is no known exploitation of CVE-2012-5991 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Cisco Wireless Lan Controller Software
Sources
Also known as GHSA-6hqg-ghvh-32h4.