CVE-2016-9221

A Denial of Service Vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause authentication to fail. Affected Products: This vulnerability affects Cisco Mobility Express 2800 Series and 3800 Series Access Points when configured in local mode in 40 MHz. More Information: CSCvb33575. Known Affected Releases: 8.2(121.12) 8.4(1.82). Known Fixed Releases: 8.2(131.2) 8.2(131.3) 8.2(131.4) 8.2(141.0) 8.3(104.53) 8.3(104.54) 8.4(1.80) 8.4(1.85).

CVSS v3 4.3 MEDIUM
CVSS v2.0 3.3 LOW

4.3^/10

CVSS v3 : MEDIUM

Vector : AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/95631	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-cme2	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:cisco:aironet_access_point_software:8.2\(121.12\):::::::*
	cpe:2.3:o:cisco:aironet_access_point_software:8.4\(1.82\):::::::*

History

No history.

Information

Published : 2017-01-26 07:59

Updated : 2024-02-04 19:11

NVD link : CVE-2016-9221

Mitre link : CVE-2016-9221

CVE.ORG link : CVE-2016-9221

JSON object : View

Products Affected

cisco

aironet_access_point_software

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2016-9221", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2017-01-26T07:59:00.247", "references": [{"url": "http://www.securityfocus.com/bid/95631", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-cme2", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "A Denial of Service Vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause authentication to fail. Affected Products: This vulnerability affects Cisco Mobility Express 2800 Series and 3800 Series Access Points when configured in local mode in 40 MHz. More Information: CSCvb33575. Known Affected Releases: 8.2(121.12) 8.4(1.82). Known Fixed Releases: 8.2(131.2) 8.2(131.3) 8.2(131.4) 8.2(141.0) 8.3(104.53) 8.3(104.54) 8.4(1.80) 8.4(1.85)."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio en el manejo de la autenticaci\u00f3n de conexi\u00f3n de ingreso 802.11 para los Access Points (APs) 2800 y 3800 de Cisco Mobility Express podr\u00eda permitir a un atacante adyacente no autenticado provocar que la autenticaci\u00f3n falle. Productos afectados: Esta vulnerabilidad afecta a Cisco Mobility Express 2800 Series y 3800 Series Access Points cuando son configurados en modo local en 40 MHz. M\u00e1s informaci\u00f3n: CSCvb33575. Lanzamientos afectados conocidos: 8.2(121.12) 8.4(1.82). Lanzamientos reparados conocidos: 8.2(131.2) 8.2(131.3) 8.2(131.4) 8.2(141.0) 8.3(104.53) 8.3(104.54) 8.4(1.80) 8.4(1.85)."}], "lastModified": "2017-01-27T19:39:59.950", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:aironet_access_point_software:8.2\\(121.12\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49309998-D816-43BC-BA6D-BE1BFE383DA8"}, {"criteria": "cpe:2.3:o:cisco:aironet_access_point_software:8.4\\(1.82\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6959C12E-AEC2-415E-972D-18B6D9D717EB"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}