Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability

Vulnerability

A deadlock condition exists in the Cisco Aironet Series Access Points (APs) software when an affected AP attempts to dequeue aggregated traffic destined to an attacker-controlled wireless client. This vulnerability affects Cisco 1560, 1800, 2800, and 3800 Series Access Points running a vulnerable release of Cisco Mobility Express (ME) Software [1]. The deadlock occurs when an attacker transitions between multiple Service Set Identifiers (SSIDs) hosted on the same AP while replicating specific traffic patterns.

Exploitation

An attacker must be authenticated and adjacent to the affected AP. The attacker must be able to transition between multiple SSIDs hosted on the same AP and replicate the required traffic patterns to trigger the deadlock condition. No additional privileges or user interaction beyond authentication is required [1].

Impact

Successful exploitation causes the AP to reload unexpectedly due to a watchdog timer detecting the deadlock, resulting in a denial of service (DoS) condition while the device restarts. The impact is limited to temporary loss of wireless connectivity for clients associated with the affected AP [1].

Mitigation

Cisco has released software updates to address this vulnerability. Administrators should upgrade to a fixed Cisco Mobility Express Software release as specified in the Cisco Security Advisory [1]. No workarounds are available. The Cisco Aironet 1550 Series Outdoor Access Point is end-of-life and was not investigated; users should migrate to supported products.