CVE-2017-12279 Information disclosure in Cisco IOS Software for Cisco Aironet Access Points
An unauthenticated adjacent attacker can retrieve confidential memory content from Cisco Aironet Access Points by sending crafted IP packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12279?
CVE-2017-12279 is a medium-severity vulnerability in Cisco IOS Software for Cisco Aironet Access Points, published on 2 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the packet processing code of Cisco IOS Software for Cisco Aironet Access Points could allow an unauthenticated, adjacent attacker to retrieve content from memory on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to insufficient condition checks that are performed by the affected device when the device adds padding to egress packets. An attacker could exploit this vulnerability by sending a crafted IP packet to an affected device. A successful exploit could allow the attacker to retrieve content from memory on the affected device, which could lead to the disclosure of confidential information. Cisco Bug IDs: CSCvc21581.
Weakness: CWE-200
Which versions are affected by CVE-2017-12279?
It affects 1 product.
Products include Cisco Aironet Ap Firmware.
How do I fix CVE-2017-12279?
No fix has been published for CVE-2017-12279 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-12279 being exploited?
There is no known exploitation of CVE-2017-12279 in the wild and no public exploit code.
Sources
Also known as GHSA-cpcj-gq92-47mr.