Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vulnerabilities

Vulnerability

Multiple command injection vulnerabilities exist in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless Access Points (models in the WAP125, WAP150, WAP361, WAP581, WAP121, WAP131, WAP321, and WAP351 families). The flaws arise from improper validation of user-supplied input. Affected firmware versions were those prior to the fixed releases: 1.0.4.3 for WAP125, 1.1.3.2 for WAP150 and WAP361, and 1.0.4.4 for WAP581. WAP121, WAP131, WAP321, and WAP351 are end-of-life and will not receive fixes [1].

Exploitation

An attacker must first obtain valid administrative credentials for the device. With those credentials, the attacker sends crafted HTTP requests to the web-based management interface of the affected access point. The forged requests inject operating system commands into fields that are not properly sanitized, leading to command execution [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges on the device. This gives the attacker full control over the wireless access point, enabling activities such as modifying configuration, intercepting network traffic, or pivoting to other internal resources [1].

Mitigation

Cisco released fixed firmware versions: 1.0.4.3 for WAP125, 1.1.3.2 for WAP150 and WAP361, and 1.0.4.4 for WAP581. For the end-of-life WAP121, WAP131, WAP321, and WAP351 devices, no firmware updates are available; customers are advised to migrate to supported products as detailed in the associated end-of-life notices. No workaround is documented. There is no indication that this CVE is listed in the CISA Known Exploited Vulnerabilities catalog as of the publication date [1].