Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vulnerabilities

Vulnerability

Multiple command injection vulnerabilities exist in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points, including models WAP125, WAP150, WAP361, WAP581, as well as end-of-life models WAP121, WAP131, WAP321, and WAP351 [1]. The vulnerabilities are due to improper validation of user-supplied input. An attacker must have valid administrative credentials to reach the vulnerable code path.

Exploitation

An authenticated remote attacker can exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected device. The attacker first authenticates with valid administrative credentials, then submits a malicious HTTP request containing injected commands.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges on the device, resulting in full compromise of the access point.

Mitigation

Cisco has released fixed firmware versions for some models: WAP125 version 1.0.4.3, WAP150 and WAP361 version 1.1.3.2, and WAP581 version 1.0.4.4 [1]. For the end-of-life models WAP121, WAP131, WAP321, and WAP351, no firmware updates will be released; customers are advised to migrate to supported products [1]. No workarounds are available.