Lucene search

K
nessusThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.CISCO-SA-20160113-WLC.NASL
HistoryJan 22, 2016 - 12:00 a.m.

Cisco Wireless LAN Controller Unauthorized Access Vulnerability

2016-01-2200:00:00
This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
21

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

73.3%

The remote Cisco Wireless LAN Controller (WLC) is affected by an unauthorized access vulnerability due to an unspecified flaw. An unauthenticated, remote attacker who can connect to the device can exploit this to modify the device configuration, resulting in complete compromise of the device.

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(88103);
  script_version("1.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/08/20");

  script_cve_id("CVE-2015-6314");
  script_bugtraq_id(80499);
  script_xref(name:"CISCO-SA", value:"cisco-sa-20160113-wlc");
  script_xref(name:"CISCO-BUG-ID", value:"CSCuw06153");

  script_name(english:"Cisco Wireless LAN Controller Unauthorized Access Vulnerability");
  script_summary(english:"Checks the WLC version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security update.");
  script_set_attribute(attribute:"description", value:
"The remote Cisco Wireless LAN Controller (WLC) is affected by an
unauthorized access vulnerability due to an unspecified flaw. An
unauthenticated, remote attacker who can connect to the device can
exploit this to modify the device configuration, resulting in complete
compromise of the device.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-wlc
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7527f49c");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant patch referenced in Cisco bug ID CSCuw06153, or
contact the vendor regarding patch options.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-6314");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/01/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/01/22");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:wireless_lan_controller_software");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:wireless_lan_controller");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_wlc_version.nasl");
  script_require_keys("Host/Cisco/WLC/Version", "Host/Cisco/WLC/Model", "Host/Cisco/WLC/Port");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

version = get_kb_item_or_exit("Host/Cisco/WLC/Version");
model = get_kb_item_or_exit("Host/Cisco/WLC/Model");
port = get_kb_item_or_exit("Host/Cisco/WLC/Port");


if (
  model !~ "(^|[^0-9])25\d\d($|[^0-9])" &&
  model !~ "(^|[^0-9])55\d\d($|[^0-9])" &&
  model !~ "(^|[^0-9])85\d\d($|[^0-9])" &&
  model !~ "(^|[^0-9])75\d\d($|[^0-9])" &&
  (
     model >!< "SRE" &&
    model !~ "(^|[^0-9])300($|[^0-9])" &&
    model !~ "(^|[^0-9])700($|[^0-9])" &&
    model !~ "(^|[^0-9])710($|[^0-9])" &&
    model !~ "(^|[^0-9])900($|[^0-9])" &&
    model !~ "(^|[^0-9])910($|[^0-9])"
  ) &&
  model >!< "WiSM-2"
) audit(AUDIT_HOST_NOT, "an affected model");

######################
# Known Affected :
# 7.6.120.0 or later
# 8.0 or later
# 8.1 or later
######################
# Known Fixed :
# 7.6.130.33 and higher (special escalation code)
# 8.0.120.7 and higher (special escalation code)
# 8.0.121.0
# 8.1.131.0
# 8.2.100.0 and higher
######################

fixed_version = "";
if (
  (ver_compare(ver:version, fix:"7.6.120.0", strict:FALSE) >= 0) &&
  (ver_compare(ver:version, fix:"7.6.130.33", strict:FALSE) < 0)
) fixed_version = "See solution.";
else if (
  (ver_compare(ver:version, fix:"8.0", strict:FALSE) >= 0) &&
  (ver_compare(ver:version, fix:"8.0.120.7", strict:FALSE) < 0)
) fixed_version = "8.0.121.0";
else if (
  (ver_compare(ver:version, fix:"8.1", strict:FALSE) >= 0) &&
  (ver_compare(ver:version, fix:"8.1.131.0", strict:FALSE) < 0)
) fixed_version = "8.1.131.0";
else audit(AUDIT_HOST_NOT, "affected");

if (report_verbosity > 0)
{
  report =
    '\n  Model             : ' + model +
    '\n  Installed version : ' + version +
    '\n  Fixed version     : ' + fixed_version +
    '\n';
  security_hole(port:port, extra:report);
}
else security_hole(port);
VendorProductVersionCPE
ciscowireless_lan_controller_softwarecpe:/o:cisco:wireless_lan_controller_software
ciscowireless_lan_controllercpe:/h:cisco:wireless_lan_controller

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

73.3%

Related for CISCO-SA-20160113-WLC.NASL