Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Denial of Service Vulnerabilities

Vulnerability

The Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing component in Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers contains multiple denial of service (DoS) vulnerabilities (CVE-2021-34769). These vulnerabilities stem from insufficient validation of CAPWAP packets [1]. An unauthenticated, remote attacker can trigger a crash and reload of the affected device by sending a single malformed CAPWAP packet. The issue affects unspecified versions of Cisco IOS XE Software running on Catalyst 9800 Series Wireless Controllers and embedded wireless controllers on Catalyst 9000 Series switches [1].

Exploitation

An attacker does not require any authentication or prior access to the target device. The exploit vector is network-based: the attacker sends a crafted CAPWAP packet to an affected device over UDP ports 5246 or 5247 [1]. No user interaction is needed. The malformed packet bypasses input validation due to the insufficient checks in the CAPWAP processing code, causing a buffer overread or null pointer dereference that leads to a system crash [1].

Impact

Successful exploitation results in a denial of service condition: the affected wireless controller crashes and reloads, temporarily disrupting wireless services for all connected access points and clients. The impact is limited to availability; there is no indication of information disclosure or code execution. The attack can be repeated as long as the attacker can reach the device over the network [1].

Mitigation

Cisco released free software updates for Cisco IOS XE Software to address these vulnerabilities. The fixed versions are available from the Cisco Software Center. Customers with service contracts should upgrade to the recommended release as indicated in Cisco Security Advisory cisco-sa-ewlc-capwap-dos-gmNjdKOY [1]. There is no known workaround that mitigates the vulnerability without upgrading. The advisory also provides guidance for customers without service contracts to obtain the fix via the Cisco TAC [1].