CVE-2019-15261

A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Generic Routing Encapsulation (GRE) frames that pass through the data plane of an affected AP. An attacker could exploit this vulnerability by associating to a vulnerable AP, initiating a PPTP VPN connection to an arbitrary PPTP VPN server, and sending a malicious GRE frame through the data plane of the AP. A successful exploit could allow the attacker to cause an internal process of the targeted AP to crash, which in turn would cause the AP to reload. The AP reload would cause a DoS condition for clients that are associated with the AP.

CVSS v3 8.6 HIGH
CVSS v2.0 7.8 HIGH

8.6^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

7.8^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos	Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:cisco:aironet_1810_firmware::::::::
	cpe:2.3:o:cisco:aironet_1810_firmware::::::::
	cpe:2.3:o:cisco:aironet_1810_firmware::::::::

cpe:2.3:h:cisco:aironet_1810:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:cisco:aironet_1830_firmware::::::::
	cpe:2.3:o:cisco:aironet_1830_firmware::::::::
	cpe:2.3:o:cisco:aironet_1830_firmware::::::::

cpe:2.3:h:cisco:aironet_1830:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

OR	cpe:2.3:o:cisco:aironet_1850_firmware::::::::
	cpe:2.3:o:cisco:aironet_1850_firmware::::::::
	cpe:2.3:o:cisco:aironet_1850_firmware::::::::

cpe:2.3:h:cisco:aironet_1850:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:28

Type	Values Removed	Values Added
References	~~() https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos - Vendor Advisory~~	() https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos - Vendor Advisory

Information

Published : 2019-10-16 19:15

Updated : 2024-11-21 04:28

NVD link : CVE-2019-15261

Mitre link : CVE-2019-15261

CVE.ORG link : CVE-2019-15261

JSON object : View

Products Affected

cisco

aironet_1810
aironet_1830_firmware
aironet_1810_firmware
aironet_1850
aironet_1850_firmware
aironet_1830

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2019-15261", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2019-10-16T19:15:13.847", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-airo-pptp-dos", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Generic Routing Encapsulation (GRE) frames that pass through the data plane of an affected AP. An attacker could exploit this vulnerability by associating to a vulnerable AP, initiating a PPTP VPN connection to an arbitrary PPTP VPN server, and sending a malicious GRE frame through the data plane of the AP. A successful exploit could allow the attacker to cause an internal process of the targeted AP to crash, which in turn would cause the AP to reload. The AP reload would cause a DoS condition for clients that are associated with the AP."}, {"lang": "es", "value": "Una vulnerabilidad en la funcionalidad de procesamiento de paquetes Point-to-Point Tunneling Protocol (PPTP) VPN en Cisco Aironet Access Points (APs), podr\u00eda permitir a un atacante remoto no autenticado causar la recarga de un dispositivo afectado, resultando en una condici\u00f3n de denegaci\u00f3n de servicio (DoS). La vulnerabilidad es debido a una comprobaci\u00f3n insuficiente de las tramas Generic Routing Encapsulation (GRE) que pasan por medio del plano de datos de un AP afectado. Un atacante podr\u00eda explotar esta vulnerabilidad al asociarse en un AP vulnerable, iniciar una conexi\u00f3n VPN PPTP a un servidor VPN PPTP arbitrario y enviar una trama GRE maliciosa por medio del plano de datos del AP. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante causar que un proceso interno del AP objetivo se bloquee, lo que a su vez causar\u00eda que el AP se recargue. La recarga AP provocar\u00eda una condici\u00f3n DoS para los clientes que est\u00e1n asociados con el AP."}], "lastModified": "2024-11-21T04:28:19.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:aironet_1810_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0EB1E05-D03C-419E-A0D7-5C8CC944D38B", "versionEndExcluding": "8.5.151.0", "versionStartIncluding": "8.4"}, {"criteria": "cpe:2.3:o:cisco:aironet_1810_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F8A1D80-EF83-42FD-BB13-243EA2049EE4", "versionEndExcluding": "8.8.125.0", "versionStartIncluding": "8.8"}, {"criteria": "cpe:2.3:o:cisco:aironet_1810_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1081F9D9-1B44-47FB-A0D5-3398D2979D50", "versionEndExcluding": "8.9.111.0", "versionStartIncluding": "8.9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:aironet_1810:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "36F923CF-D4EB-48F8-821D-8BB3A69ABB62"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:aironet_1830_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D6EA9B7-CB0F-4E9E-A31C-F8F88CB429D9", "versionEndExcluding": "8.5.151.0", "versionStartIncluding": "8.4"}, {"criteria": "cpe:2.3:o:cisco:aironet_1830_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3042B1FA-368C-4340-B058-FF57C225E09A", "versionEndExcluding": "8.8.125.0", "versionStartIncluding": "8.8"}, {"criteria": "cpe:2.3:o:cisco:aironet_1830_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "786B186D-FD13-48A4-AB4E-1BE480465F3C", "versionEndExcluding": "8.9.111.0", "versionStartIncluding": "8.9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:aironet_1830:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "093AB3A8-853B-4094-BFB5-6A8775AAA8D3"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:aironet_1850_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB295008-4127-477D-B3FD-279F0C168AFC", "versionEndExcluding": "8.5.151.0", "versionStartIncluding": "8.4"}, {"criteria": "cpe:2.3:o:cisco:aironet_1850_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD7F885D-F60A-4DA9-8023-7A3F3A3F509B", "versionEndExcluding": "8.8.125.0", "versionStartIncluding": "8.8"}, {"criteria": "cpe:2.3:o:cisco:aironet_1850_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "155A2052-5460-4ED9-BE28-51453906BE32", "versionEndExcluding": "8.9.111.0", "versionStartIncluding": "8.9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:aironet_1850:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BE0B76A8-377E-4176-8F04-B0D468D4E767"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}

8.6 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

7.8 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

JSON object

Attach tags to CVE-2019-15261

8.6^/10

7.8^/10

Attach tags to `CVE-2019-15261`