CVE-2019-1805: Cisco Wireless LAN Controller Secure Shell Unauthorized Access Vulnerability

Published Apr 18, 2019

Updated

A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to access a CLI instance on an affected device. The vulnerability is due to a lack of proper input- and validation-checking mechanisms for inbound SSH connections on an affected device. An attacker could exploit this vulnerability by attempting to establish an SSH connection to an affected controller. An exploit could allow the attacker to access an affected device's CLI to potentially cause further attacks. This vulnerability has been fixed in version 8.5(140.0).

Affected Software

1 affected component

Cisco Wireless LAN Controller Software=8.3\(141.0\)

Event History

Apr 18, 2019

CVE Published

via MITRE·01:10 AM

Data Sourced

via MITRE·01:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:29 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2019-1805.

What is the severity of CVE-2019-1805?

The severity of CVE-2019-1805 is medium with a severity value of 4.3.

What is the affected software for CVE-2019-1805?

The affected software for CVE-2019-1805 is Cisco Wireless LAN Controller Software version 8.3(141.0).

How can an attacker exploit CVE-2019-1805?

An unauthenticated, adjacent attacker can exploit CVE-2019-1805 to access a CLI instance on an affected device.

Is there a fix available for CVE-2019-1805?

Yes, Cisco has provided a fix for CVE-2019-1805. Please refer to the Cisco Security Advisory for more information.