CVE-2019-15260 Cisco Aironet Access Points Unauthorized Access Vulnerability
Unauthenticated remote attackers can access specific URLs to gain elevated privileges, view sensitive data, modify wireless configurations, or disable the access point.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15260?
CVE-2019-15260 is a critical missing authorization vulnerability in Cisco Aironet Access Point Software, published on 16 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Cisco Aironet Access Points (APs) Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device with elevated privileges. The vulnerability is due to insufficient access control for certain URLs on an affected device. An attacker could exploit this vulnerability by requesting specific URLs from an affected AP. An exploit could allow the attacker to gain access to the device with elevated privileges. While the attacker would not be granted access to all possible configuration options, it could allow the attacker to view sensitive information and replace some options with values of their choosing, including wireless network configuration. It would also allow the attacker to disable the AP, creating a denial of service (DoS) condition for clients associated with the AP.
Weakness: CWE-284
Which versions are affected by CVE-2019-15260?
It affects 6 products.
Products include Cisco Aironet 1540 Firmware, Cisco Aironet 1560 Firmware, Cisco Aironet 1800 Firmware, Cisco Aironet 2800 Firmware, Cisco Aironet 3800 Firmware, Cisco Aironet 4800 Firmware.
How do I fix CVE-2019-15260?
No fix has been published for CVE-2019-15260 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-15260 being exploited?
There is no known exploitation of CVE-2019-15260 in the wild and no public exploit code.
Other vulnerabilities in Cisco Aironet Access Point Software
Sources
Also known as GHSA-rfr3-7m2c-w5hg.