Vulnslist

find the latest Cisco vulnerabilities

Cisco Aironet Access Points Bridge Protocol Data Unit Port Disable Denial of Service Vulnerability

cisco-sa-20191016-airo-dos · Medium · Published · Updated

A vulnerability in the bridge protocol data unit (BPDU) forwarding functionality of Cisco Aironet Access Points (APs) could allow an unauthenticated, adjacent attacker to cause an AP port to go into an error disabled state. The vulnerability occurs because BPDUs received from specific wireless clients are forwarded incorrectly. An attacker could exploit this vulnerability on the wireless network by sending a steady stream of crafted BPDU frames. A successful exploit could allow the attacker to cause a limited denial of service (DoS) attack because an AP port could go offline. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-dos

Cisco advisory ·CSAF JSON

Workarounds

A possible workaround for the vulnerability is to reconfigure the Aironet AP port from spanning-tree bpduguard enable to spanning-tree bpdu filtering.

CVEsCVE-2019-15265
Cisco Bug IDsCSCvn80147
CVSS ScoreBase 7.4
Base 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
Product Names From Source
Cisco Aironet Access Point Software

Related Products

Product CVE Evidence
Cisco RV Series Routers CVE-2019-15265 Cisco OpenVuln
Cisco Nexus Dashboard CVE-2019-15265 Cisco OpenVuln
Cisco Aironet Access Point Software CVE-2019-15265 Cisco OpenVuln