Cisco Aironet Access Points WLAN Control Protocol Packet Buffer Leak Denial of Service Vulnerability

Vulnerability

The vulnerability resides in the WLAN Control Protocol (WCP) implementation of Cisco Aironet Access Point (AP) software. It stems from incorrect error handling when the device receives an unexpected 802.11 frame. Affected versions include releases prior to the fixed versions indicated in Cisco Security Advisory cisco-sa-airo-wpa-pktleak-dos-uSTyGrL [1]. The vulnerability does not require any special configuration to be exploitable.

Exploitation

An unauthenticated attacker with adjacency to the wireless network can exploit this vulnerability by sending specially crafted 802.11 frames to an interface on the affected AP. No authentication or user interaction is required. The attacker simply needs to be within radio range and transmit the malicious frames.

Impact

Successful exploitation leads to a packet buffer leak, which over time causes buffer allocation failures. This eventually triggers a reload of the affected device, resulting in a denial of service (DoS) condition. No information disclosure or privilege escalation occurs; the impact is solely on availability.

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade their Aironet AP software to the fixed versions listed in the Cisco Security Advisory [1]. No workarounds are available. Devices running software versions prior to the fixed releases are considered vulnerable.