Cisco Aironet Series Access Points Denial of Service Vulnerability

Vulnerability

The vulnerability exists because the Cisco Aironet Series Access Points (APs) forward some malformed wireless client packets outside of the Control and Provisioning of Wireless Access Points (CAPWAP) tunnel. This behavior can trigger a security violation on the adjacent switch port if that port has port security configured. Affected APs include various models; see advisory [1] for details. Note: Though the CVSS score is High, this issue is considered Medium because a workaround exists and exploitation requires a specific switch configuration.

Exploitation

An unauthenticated attacker within wireless range of an affected AP can send crafted wireless packets to the AP. The AP then forwards these packets outside the CAPWAP tunnel to the adjacent switch interface. If that switch port has port security enabled, the malformed packets may cause a security violation, leading to the port being disabled and resulting in a denial of service (DoS) condition on the AP and potentially affecting client connectivity through that port. No authentication or special access is needed; the attacker only needs to be adjacent.

Impact

A successful exploit can cause a denial of service on the affected AP and may also disrupt connectivity for clients relying on the adjacent switch port. The attacker gains no other access or information; the impact is limited to availability.

Mitigation

Workarounds are available. Configure port security on the switch interface where the AP is connected to block malicious packets. Alternatively, disable CAPWAP tunnel fragmentation on the AP. Cisco has not announced a permanent fix at this time; the vulnerability is considered Medium due to available workarounds.