CVE-2013-1104 Code injection in n/a
Remote authenticated attackers can execute arbitrary code on Cisco Wireless LAN Controllers via a crafted HTTP User-Agent header.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-1104?
CVE-2013-1104 is a critical code injection vulnerability in Cisco Wireless Lan Controller Software, published on 24 Jan 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP User-Agent header, aka Bug ID CSCuc15636.
Which versions are affected by CVE-2013-1104?
It affects 9 products.
Products include Cisco 2000 Wireless Lan Controller, Cisco 2100 Wireless Lan Controller, Cisco 2500 Wireless Lan Controller, Cisco 4100 Wireless Lan Controller, Cisco 4400 Wireless Lan Controller, Cisco 5500 Wireless Lan Controller and 3 more.
How do I fix CVE-2013-1104?
No fix has been published for CVE-2013-1104 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2013-1104 being exploited?
There is no known exploitation of CVE-2013-1104 in the wild and no public exploit code.
Other vulnerabilities in Cisco Wireless Lan Controller Software
Sources
Also known as GHSA-rcx4-p563-6mqv.