Cisco Aironet Access Points Bridge Protocol Data Unit Port Disable Denial of Service Vulnerability

Vulnerability

A vulnerability exists in the bridge protocol data unit (BPDU) forwarding functionality of Cisco Aironet Access Points (APs). It occurs because BPDUs received from specific wireless clients are forwarded incorrectly. An unauthenticated, adjacent attacker can exploit this by sending a steady stream of crafted BPDU frames on the wireless network. The vulnerability affects Aironet 1540, 1560, 1800, 2800, and 3800 Series APs running a vulnerable software release, with the first vulnerable release being 8.5 [1].

Exploitation

The attacker must be within the wireless range of the target AP (adjacent network access) and requires no authentication. The exploitation involves sending a continuous stream of specially crafted BPDU frames to the AP. The AP then incorrectly forwards these frames, causing the targeted port to enter an error-disabled state [1].

Impact

Successful exploitation results in a limited denial of service (DoS) condition, as the affected AP port goes offline. This disrupts network connectivity for clients associated with that port, but does not lead to information disclosure, privilege escalation, or remote code execution [1].

Mitigation

Cisco has released software updates to address this vulnerability. The advisory recommends consulting the Cisco Security Advisory for the latest fixed releases [1]. A workaround is available: reconfigure the Aironet AP port from spanning-tree bpduguard enable to spanning-tree bpdu filtering [1].