description: A vulnerability in the networking component of Cisco access point (AP) software could allow an unauthenticated, remote attacker to cause a temporary disruption of service.
This vulnerability is due to overuse of AP resources. An attacker could exploit this vulnerability by connecting to an AP on an affected device as a wireless client and sending a high rate of traffic over an extended period of time. A successful exploit could allow the attacker to cause the Datagram TLS (DTLS) session to tear down and reset, causing a denial of service (DoS) condition.
problem types: Uncontrolled Resource Consumption
affected:
{
vendor: Cisco
product: Cisco Aironet Access Point Software
versions:
version: 8.10.170.0, status: affected
}
{
vendor: Cisco
product: Cisco Aironet Access Point Software (IOS XE Controller)
versions:
version: 16.10.1e, status: affected
version: 16.10.1, status: affected
version: 17.1.1t, status: affected
version: 17.1.1s, status: affected
version: 17.1.1, status: affected
version: 16.11.1a, status: affected
version: 16.11.1, status: affected
version: 16.11.1c, status: affected
version: 16.11.1b, status: affected
version: 16.12.1s, status: affected
version: 16.12.4, status: affected
version: 16.12.1, status: affected
version: 16.12.2s, status: affected
version: 16.12.1t, status: affected
version: 16.12.4a, status: affected
version: 16.12.5, status: affected
version: 16.12.3, status: affected
version: 16.12.6, status: affected
version: 16.12.8, status: affected
version: 16.12.7, status: affected
version: 16.12.6a, status: affected
version: 17.3.1, status: affected
version: 17.3.2a, status: affected
version: 17.3.3, status: affected
version: 17.3.2, status: affected
version: 17.3.4c, status: affected
version: 17.3.5a, status: affected
version: 17.3.6, status: affected
version: 17.2.1, status: affected
version: 17.2.1a, status: affected
version: 17.2.3, status: affected
version: 17.2.2, status: affected
version: 17.5.1, status: affected
version: 17.4.1, status: affected
version: 17.4.2, status: affected
version: 17.6.1, status: affected
version: 17.6.2, status: affected
version: 17.6.3, status: affected
version: 17.6.4, status: affected
version: 17.6.5, status: affected
version: 17.7.1, status: affected
version: 17.8.1, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
baseScore: 5.8
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
]
exploits: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.