Cisco IOS XE Software Wireless Controller for the Catalyst 9000 Family Improper Access Control (cisco-sa-ewlc-icmpv6-qb9eYyCR)

medium Nessus Plugin ID 144197

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family Routers is affected by an improper access control vulnerability due to an incomplete access control list (ACL) being applied prior to RUN state. An attacker could exploit this vulnerability by connecting to the associated service set identifier (SSID) and sending ICMPv6 traffic. A successful exploit could allow the attacker to send ICMPv6 traffic prior to RUN state.

Please see the included Cisco BID and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvr07309

Plugin Details

Severity: Medium

ID: 144197

File Name: cisco-sa-ewlc-icmpv6-qb9eYyCR-iosxe.nasl

Version: 1.11

Type: combined

Family: CISCO

Published: 12/14/2020

Updated: 5/3/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 1.6

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.4

Vector: CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2020-3418

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:ios_xe

Required KB Items: Host/Cisco/IOS-XE/Version, Host/Cisco/IOS-XE/Model

Exploit Ease: No known exploits are available

Patch Publication Date: 9/24/2020

Vulnerability Publication Date: 9/24/2020

Reference Information

CVE: CVE-2020-3418

CWE: 284

CISCO-SA: cisco-sa-ewlc-icmpv6-qb9eYyCR

IAVA: 2020-A-0439-S

CISCO-BUG-ID: CSCvr07309

Detections

Analytics