Cisco Wireless LAN Controller SNMP Unauthorized Access Vulnerability

Release date:
Updated on:

Affected Systems:
Cisco Wireless LAN Control 7.2
Cisco Wireless LAN Control 7.1
Cisco Wireless LAN Control 7.0
Unaffected system:
Cisco Wireless LAN Control 7.2.103.0
Cisco Wireless LAN Control 7.1.91.0
Cisco Wireless LAN Control 7.0.220.0
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57524
CVE (CAN) ID: CVE-2013-1105
 
Cisco WLC is responsible for system-wide wireless LAN functions, such as security policies, intrusion protection, RF management, service quality and mobility.
 
The Cisco WLC device has an unauthorized access vulnerability. Even if the "management over wireless" feature is disabled, authenticated attackers can view and modify the configuration of the affected Cisco WLC through SNMP.
 
<* Source: Cisco

Link: http://seclists.org/fulldisclosure/2013/Jan/208
Http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Cisco
-----
Cisco has released a Security Bulletin (cisco-sa-20130123-wlc) and patches for this:
 
Cisco-sa-20130123-wlc: Multiple Vulnerabilities in Cisco Wireless LAN Controllers
Link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc