Title: Cisco Wireless Control System Multiple Vulnerabilities
Severity: CRITICAL
Description:
Cisco Wireless Control System (WCS) is used with Cisco wireless appliances to provide system configuration, location tracking, security monitoring, and wireless LAN management.
WCS is prone to multiple vulnerabilities. These issues include:
- An unauthorized-access vulnerability occurs because WCS uses an unchangeable username and password for performing backup operations via FTP. Attackers with knowledge of the account credentials can gain access to affected devices.
- A privilege-escalation vulnerability occurs because authenticated users can add themselves to account groups with higher privileges.
- An information-disclosure vulnerability occurs because of a lack of password protection on certain directories in the WCS page hierarchy. Unauthenticated attackers may retrieve sensitive information such as access points and the internal network.
An attacker can exploit these issues to obtain sensitive information, gain unauthorized access, and elevate privileges, which will compromise affected devices and aid in further attacks.
Successful exploits will result in a complete compromise of affected devices.
Versions prior to 4.0.96.0 are vulnerable.
These issues are being tracked by Cisco Bug IDs:
CSCse93014
CSCse78596
CSCsg05190
CSCsg04301
Affected Products:
- Cisco Wireless Control System Software 4.0.0
- Cisco Wireless Control System Software 4.0.95
References:
- Cisco: Cisco Homepage
- Cisco: Cisco Security Advisory: Multiple Vulnerabilities in the Cisco Wireless Control
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
