Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vulnerabilities

Vulnerability

An authenticated, remote command injection vulnerability exists in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points. The flaw stems from improper validation of user-supplied input when processing HTTP requests [1]. Affected products include the WAP125 (fixed in 1.0.4.3), WAP150 (fixed in 1.1.3.2), WAP361 (fixed in 1.1.3.2), and WAP581 (fixed in 1.0.4.4). The WAP121, WAP131, WAP321, and WAP351 are also affected but are end-of-life and will not receive fixes [1]. The attacker must have valid administrative credentials for the device.

Exploitation

An attacker with valid administrative credentials must send crafted HTTP requests to the web-based management interface of an affected device [1]. The improper input validation allows the attacker to inject arbitrary commands that are executed on the underlying operating system. No other user interaction or network position beyond reachability of the HTTP interface is required.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges on the affected device [1]. This results in complete compromise of the access point, including full control over its operations, modification of configuration, and potential lateral movement within the network from a position of high privilege.

Mitigation

Cisco has released firmware updates for the following models: WAP125 (1.0.4.3), WAP150 (1.1.3.2), WAP361 (1.1.3.2), and WAP581 (1.0.4.4) [1]. The WAP121, WAP131, WAP321, and WAP351 are end-of-life and will not receive patches; customers should migrate to a supported, non-vulnerable product [1]. No workaround for the vulnerability has been published as of the advisory date.