Cisco has released security patches to fix a critical vulnerability (CVSS score 10), tracked as CVE-2022-20695, in Cisco Wireless LAN Controller (WLC). A remote, unauthenticated attacker could exploit the flaw to bypass authentication and log in to the device through the management interface.
The vulnerability resides in the authentication feature of Cisco Wireless LAN Controller (WLC) Software.
“This vulnerability is due to the improper implementation of the password validation algorithm. An attacker could exploit this vulnerability by logging in to an affected device with crafted credentials. A successful exploit could allow the attacker to bypass authentication and log in to the device as an administrator.” reads the advisory published by Cisco. “The attacker could obtain privileges that are the same level as an administrative user but it depends on the crafted credentials.”
This vulnerability affects Cisco products running Cisco WLC Software Release 18.104.22.168 or Release 22.214.171.124 and have macfilter radius compatibility configured as Other:
Users can determine whether the Cisco WLC configuration is vulnerable using the show macfilter summary CLI command.
wlc > show macfilter summary
The CVE-2022-20695 vulnerability does not affect the following products:
Below are the Cisco software releases that address this issue:
|Cisco Wireless LAN Controller Release||First Fixed Release|
|8.9 and earlier||Not vulnerable|
|126.96.36.199 and earlier||Not vulnerable|
|188.8.131.52 and later||184.108.40.206|
The Cisco PSIRT is not aware of any attack in the wild exploiting this vulnerability
Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform
(SecurityAffairs – hacking, Cisco Wireless LAN Controller)