Cisco Aironet Series Access Points Development Shell Access Vulnerability

Vulnerability

A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system allows an authenticated, local attacker to access the development shell without proper authentication, leading to root access to the underlying Linux OS. The flaw exists because the software improperly validates user-supplied input at the CLI authentication prompt for devshell access. Affected software versions are prior to 8.3.150.0, 8.5.135.0, and 8.8.100.0 [1].

Exploitation

An attacker must have valid device credentials to authenticate to the AP. The attacker then enters crafted input at the CLI authentication prompt for the development shell to bypass authentication [1]. This is a local access vulnerability; the attacker does not need network access beyond connectivity to the device's CLI.

Impact

Successful exploitation of this vulnerability allows the attacker to access the AP development shell without proper authentication. From the devshell, the attacker gains root access to the underlying Linux OS, resulting in complete compromise of the device's confidentiality, integrity, and availability [1].

Mitigation

Cisco released software updates to address this vulnerability in versions 8.3.150.0, 8.5.135.0, and 8.8.100.0 and later [1]. Administrators should upgrade to a fixed release. Cisco does not list this CVE in the KEV catalog. No workarounds are available [1].