Vulnerability · Published Sep 30, 2022 · Assigned by cisco

CVE-2022-20769Cisco Wireless LAN Controller AireOS Software FIPS Mode Denial of Service Vulnerability

High 7.4

In plain English

A high-severity out-of-bounds write in Cisco Wireless LAN Controller (WLC) from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error validation. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to cause the wireless LAN controller to crash, resulting in a DoS condition. Note: This vulnerability affects only devices that have Federal Information Processing Standards (FIPS) mode enabled.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Wireless LAN Controller (WLC)	n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

References

20220928 Cisco Wireless LAN Controller AireOS Software FIPS Mode Denial of Service Vulnerability vendor-advisory, x_refsource_CISCO