Vulnslist

find the latest Cisco vulnerabilities

Cisco Application Visibility and Control FlexConnect UDP Vulnerability

Cisco-SA-20150908-CVE-2015-6286 · Medium · Published · Updated

A vulnerability in Cisco Application Visibility and Control (AVC) software for wireless networking could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper validation of UDP packets in the configuration of FlexConnect mode. An unauthenticated, adjacent attacker could exploit this vulnerability by sending a crafted UDP packet to an AP with FlexConnect mode configured. A successful exploit could allow the attacker to cause a targeted access point to become unavailable, leading to a DoS condition. Cisco confirmed the vulnerability and released software updates. To exploit this vulnerability, an attacker must be on the same collision or broadcast domain as the targeted device. This access requirement reduces the likelihood of a successful exploit. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco advisory ·CSAF JSON

Workarounds

Administrators are advised to apply the appropriate updates.

Administrators are advised to allow only trusted users to have network access.

Administrators may consider using IP-based access control lists (ACLs) to allow only trusted systems to access the affected systems.

Administrators are advised to monitor affected systems.

CVEsCVE-2015-6286
Cisco Bug IDsNA
CVSS ScoreBase 6.1
Base 6.1 AV:A/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:U/RC:C
Product Names From Source
Cisco Application Visibility and Control (AVC), Application Visibility and Control (AVC)

Related Products

Product CVE Evidence
Application Visibility and Control (AVC) CVE-2015-6286 Cisco OpenVuln
Cisco Application Visibility and Control (AVC) CVE-2015-6286 Cisco OpenVuln