Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vulnerabilities

Vulnerability

Multiple authenticated command injection vulnerabilities exist in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points. The specific affected models are Cisco WAP125 (fixed in 1.0.4.3), WAP150 (fixed in 1.1.3.2), WAP361 (fixed in 1.1.3.2), and WAP581 (fixed in 1.0.4.4). Additionally, the end-of-life (EOL) models WAP121, WAP131, WAP321, and WAP351 are affected but will not receive a fix [1]. The vulnerabilities arise from improper validation of user-supplied input sent to the web-based management interface [1].

Exploitation

An attacker must already possess valid administrative credentials for the target device. With those credentials, the attacker can send crafted HTTP requests to the web-based management interface. The improper input validation allows the attacker to inject arbitrary operating system commands within the request [1]. No user interaction beyond the initial authentication is required on the part of the device’s legitimate administrator.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root privileges. This provides full control over the affected access point, including the ability to modify configuration, exfiltrate data, disrupt network connectivity, or use the device as a pivot point for further attacks [1].

Mitigation

Cisco has released firmware updates for supported models: WAP125 to version 1.0.4.3, WAP150 and WAP361 to version 1.1.3.2, and WAP581 to version 1.0.4.4 [1]. The EOL models WAP121, WAP131, WAP321, and WAP351 will not receive fixes; Cisco recommends replacing them with a supported product as outlined in the Cisco Security Advisory [1]. There is no known workaround for the vulnerabilities. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of May 2025.