CVE-2013-1105 Missing authorization in n/a
Remote authenticated users can bypass wireless-management settings to read or modify Cisco WLC device configurations via SNMP requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-1105?
CVE-2013-1105 is a critical missing authorization vulnerability in Cisco Wireless Lan Controller Software, published on 24 Jan 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 before 7.3.101.0 allow remote authenticated users to bypass wireless-management settings and read or modify the device configuration via an SNMP request, aka Bug ID CSCua60653.
Weakness: CWE-264
Which versions are affected by CVE-2013-1105?
It affects 7 products.
Products include Cisco 2000 Wireless Lan Controller, Cisco 2100 Wireless Lan Controller, Cisco 2500 Wireless Lan Controller, Cisco 5500 Wireless Lan Controller, Cisco 7500 Wireless Lan Controller, Cisco 8500 Wireless Lan Controller and 1 more.
How do I fix CVE-2013-1105?
No fix has been published for CVE-2013-1105 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2013-1105 being exploited?
There is no known exploitation of CVE-2013-1105 in the wild and no public exploit code.
Other vulnerabilities in Cisco Wireless Lan Controller Software
Sources
Also known as GHSA-4gfq-6cg6-xc56.