Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vulnerabilities

Vulnerability

Multiple command injection vulnerabilities exist in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points. The flaws stem from improper validation of user-supplied input. Affected models include WAP125, WAP150, WAP361, WAP581, as well as the end-of-life WAP121, WAP131, WAP321, and WAP351. The vulnerable code path is reachable only by authenticated users with administrative credentials. [1]

Exploitation

An attacker must have valid administrative credentials for the device and network access to the web-based management interface. Exploitation involves sending crafted HTTP requests to the interface. No additional user interaction is required. The attacker can trigger the injection by supplying malicious input in specific HTTP parameters. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges on the affected device. This results in full compromise of the access point, including the ability to modify configuration, access sensitive data, and pivot to other network segments. [1]

Mitigation

Cisco has released fixed firmware versions for supported models: WAP125 version 1.0.4.3, WAP150 and WAP361 version 1.1.3.2, and WAP581 version 1.0.4.4. For the end-of-life models WAP121, WAP131, WAP321, and WAP351, no firmware updates will be released; customers are advised to migrate to supported products. No workarounds are available. [1]