CVE-2014-0701: High severity Cisco Wireless LAN Controller Software vulnerability
Cisco Wireless LAN Controller (WLC) devices 7.0 before 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0 do not properly deallocate memory, which allows remote attackers to cause a denial of service (reboot) by sending WebAuth login requests at a high rate, aka Bug ID CSCuf52361.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco Wireless LAN Controller (WLC)to a version that resolves this vulnerability.Fixed in 7.0.250.0 - Upgrade
Upgrade
Cisco Wireless LAN Controller (WLC)to a version that resolves this vulnerability.Fixed in 7.4.110.0 - Upgrade
Upgrade
Cisco Wireless LAN Controller (WLC)to a version that resolves this vulnerability.Fixed in 7.2 - Upgrade
Upgrade
Cisco Wireless LAN Controller (WLC)to a version that resolves this vulnerability.Fixed in 7.3 - Upgrade
Upgrade
Cisco Wireless LAN Controller (WLC)to a version that resolves this vulnerability.Patch CSCuf52361 - Compensating control
Mitigate the denial-of-service condition by limiting/rate-controlling WebAuth login requests from remote clients (e.g., via perimeter/WAF or network controls) to prevent high-rate WebAuth login request flooding that triggers the reboot.
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0701?
CVE-2014-0701 has a medium severity rating, as it can lead to a denial of service on affected Cisco Wireless LAN Controllers.
How do I fix CVE-2014-0701?
To fix CVE-2014-0701, update your Cisco Wireless LAN Controller software to version 7.0.250.0 or later for 7.0 branches and 7.4.110.0 or later for 7.4 branches.
Which devices are affected by CVE-2014-0701?
CVE-2014-0701 affects Cisco Wireless LAN Controller devices running versions prior to 7.0.250.0, 7.2, 7.3, and 7.4 before 7.4.110.0.
What type of attack can exploit CVE-2014-0701?
CVE-2014-0701 can be exploited by remote attackers sending excessive WebAuth login requests to cause a denial of service.
Is there a workaround for CVE-2014-0701 if I cannot update?
Currently, there are no published workarounds for CVE-2014-0701, and the recommended solution is to upgrade the software.