CVE-2016-9196

Vulnerability

A login authentication management vulnerability in Cisco Aironet 1800, 2800, and 3800 Series Access Point platforms allows an authenticated, local attacker to gain unrestricted root access to the underlying Linux operating system. The root Linux shell is normally reserved for advanced troubleshooting and should not be accessible to individual users, even those with root privileges. The issue arises due to incorrect management of user credentials during authentication. Affected releases include 8.2(121.0) and 8.3(102.0). Fixed releases are 8.4(1.53), 8.4(1.52), 8.3(111.0), 8.3(104.23), 8.2(130.0), and 8.2(124.1) [1].

Exploitation

An attacker must already possess the root password for the affected access point. With that credential, the attacker authenticates to the device and can then bypass the controls designed to restrict access to the root Linux shell. The exploit does not require network access beyond local console or SSH access [1]. No user interaction beyond the attacker's own actions is needed.

Impact

Successful exploitation gives the authenticated attacker unrestricted root shell access to the underlying Linux OS. This privilege escalation allows full control over the device, including the ability to execute arbitrary commands, install malicious software, and further compromise the network [1].

Mitigation

Cisco has released fixed software versions as listed above. There are no workarounds that address this vulnerability. Users should upgrade to a fixed release as indicated in the advisory [1]. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog as of this writing.