Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability

Vulnerability

The vulnerability resides in the PPTP VPN packet processing functionality of Cisco Aironet Access Points. The issue occurs due to insufficient validation of GRE frames passing through the data plane. Affected devices include various Cisco Aironet AP models running certain firmware versions. An attacker must associate with a vulnerable AP and initiate a PPTP VPN connection to an arbitrary PPTP VPN server, then send a malicious GRE frame through the data plane.

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability without any prior authentication. The attacker needs to be within wireless range to associate with the AP. The exploit sequence: associate to the AP, initiate a PPTP VPN connection to any PPTP server (attacker-controlled or not), and then send a specially crafted GRE frame. This causes an internal process to crash, leading to AP reload.

Impact

Successful exploitation causes the AP to reload, resulting in a denial of service (DoS) condition for all clients associated with that AP. No data confidentiality or integrity is compromised, but availability is affected.

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade to fixed firmware versions as indicated in the Cisco Security Advisory [1]. No workarounds are mentioned, but disabling PPTP VPN passthrough on the AP may mitigate risk, though not confirmed. The advisory provides instructions for obtaining updates.