Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vulnerabilities

Vulnerability

Multiple command injection vulnerabilities exist in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points (WAP). The flaws stem from improper validation of user-supplied input when processing HTTP requests. Affected products include WAP125 (release prior to 1.0.4.3), WAP150 (prior to 1.1.3.2), WAP361 (prior to 1.1.3.2), and WAP581 (prior to 1.0.4.4). The WAP121, WAP131, WAP321, and WAP351 models are end-of-life and will not receive fixes [1].

Exploitation

An attacker must have valid administrative credentials for the device. With those credentials, the attacker sends specially crafted HTTP requests to the web-based management interface. The improper input validation allows injection of arbitrary commands into underlying system calls [1].

Impact

Successful exploitation enables the attacker to execute arbitrary commands on the affected device with root privileges. This results in full compromise of the access point, including potential data exfiltration, denial of service, or use as a pivot point within the network [1].

Mitigation

Cisco has released fixed firmware versions: WAP125 1.0.4.3, WAP150 1.1.3.2, WAP361 1.1.3.2, and WAP581 1.0.4.4. For end-of-life models (WAP121, WAP131, WAP321, WAP351), no fix will be provided; users should migrate to supported products. No workarounds are documented [1].