Microsoft Windows Wireless LAN AutoConfig service buffer overflow

Buffer overflow on access point frame parsing...

Code injection

Cisco Aironet Lightweight Access Point AP devices send the contents of certain multicast data frames in cleartext, which allows remote attackers to discover Wireless LAN Controller MAC addresses and IP addresses, and AP configuration details, by sniffing the wireless network...

CVE-2009-2861

The Over-the-Air Provisioning OTAP functionality on Cisco Aironet Lightweight Access Point 1100 and 1200 devices does not properly implement access-point association, which allows remote attackers to spoof a controller and cause a denial of service service outage via crafted remote radio manageme...

CVE-2009-2976

Cisco Aironet Lightweight AP devices transmit certain multicast frames in cleartext, enabling remote attackers who sniff the wireless medium to discover Wireless LAN Controller MAC addresses, IP addresses, and AP configuration details. The connected reports reiterate this behavior without providi...

CVE-2009-2861

Cisco Aironet Lightweight Access Point 1100/1200 OTAP feature has an improper access-point association implementation, enabling remote attackers to spoof a controller and trigger a denial-of-service via crafted remote radio management (RRM) packets. No exploitation details beyond the SkyJack/CSCt...

CVE-2009-2861

The Over-the-Air Provisioning OTAP functionality on Cisco Aironet Lightweight Access Point 1100 and 1200 devices does not properly implement access-point association, which allows remote attackers to spoof a controller and cause a denial of service service outage via crafted remote radio manageme...

CVE-2008-6395

The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause a denial of service device crash via a malformed HTTP POST request...

Cross site request forgery (csrf)

The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause a denial of service device crash via a malformed HTTP POST request...

CVE-2008-6395

CVE-2008-6395 affects the web management interface of the 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point. A remote attacker can trigger a denial of service (device crash) by sending a malformed HTTP POST request. The available documents identify the affected product and impact but do not ...

Netgear WG102 SNMP Password Leak

Dear all, after informing Netgear about the unsafe handling of passwords on their WG102 Access Points nothing happened for several weeks. To inform other users about the potential threat to their networks I decided to share my findings. WG102 offers the the typical SNMP write & SNMP read communit...

Leak of SNMP write password via SNMP read community in NETGEAR WG102 - Prosafe 802.11g Access Point

Dear all, after informing Netgear about the unsafe handling of passwords on their WG102 Access Points nothing happened for several weeks. To inform other users about the potential threat to their networks I decided to share my findings. WG102 offers the the typical SNMP write & SNMP read communit...

alink-xsrfxss.xt

Louhi Networks Information Security Research Security Advisory Advisory: A-Link WL54AP3 and WL54AP2 CSRF+XSS vulnerability Release Date: 2008/10/31 Last Modified: 2008/10/28 Authors: Jussi Vuokko, CISSP [email protected] Henri Lindberg [email protected] Device: A-Link WL54AP3 and WL54AP...

CVE-2008-4441

The Marvell driver for the Linksys WAP4400N Wi-Fi access point with firmware 1.2.14 on the Marvell 88W8361P-BEM1 chipset, when WEP mode is enabled, does not properly parse malformed 802.11 frames, which allows remote attackers to cause a denial of service reboot or hang-up via a malformed...

Proxim Tsunami MP.11 2411 Wireless Access Point - system.sysName.0 SNMP HTML Injection

Proxim Tsunami MP.11 2411 Wireless Access Point - system.sysName.0 SNMP HTML Injection source: https://www.securityfocus.com/bid/31666/info The Proxim Tsunami MP.11 2411 Wireless Access Point is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input...

Proxim Tsunami MP.11 2411 Wireless Access Point - 'system.sysName.0' SNMP HTML Injection

source: https://www.securityfocus.com/bid/31666/info The Proxim Tsunami MP.11 2411 Wireless Access Point is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data. Attacker-supplied HTML and script code would run in the context of the web...

Nokia e90 (s60v3) Remote Denial of Service Vulnerability

No description provided by source. Nokia E90 and probably other devices with s60v3 crashes with aireplay The device should be authorised on an access point sample: aireplay-ng -0 10 -a 00:74:3B:0C:A0:5A -c 00:2A:29:F3:1F:42 wlan0 My HW: AP= Acorp w422g Nokia E90 v 07.40.1.2 Ra-6...

Fwd: Nokia e90 (Probably, and other devices with s60v3) Crashes

Nokia E90 and probably other devices with s60v3 crashes with aireplay The device should be authorised on an access point sample: aireplay-ng -0 10 -a 00:74:3B:0C:A0:5A -c 00:2A:29:F3:1F:42 wlan0 My HW: AP= Acorp w422g Nokia E90 v 07.40.1.2 Ra-6...

Nokia e90n82 (s60v3) - Remote Denial of Service

Nokia e90n82 s60v3 - Remote Denial of Service Nokia E90 and probably other devices with s60v3 crashes with aireplay The device should be authorised on an access point sample: aireplay-ng -0 10 -a 00:74:3B:0C:A0:5A -c 00:2A:29:F3:1F:42 wlan0 My HW: AP= Acorp w422g Nokia E90 v 07.40.1.2 Ra-6 For...

Nokia e90/n82 (s60v3) Remote Denial of Service Vulnerability

No description provided by source. Nokia E90 and probably other devices with s60v3 crashes with aireplay The device should be authorised on an access point sample: aireplay-ng -0 10 -a 00:74:3B:0C:A0:5A -c 00:2A:29:F3:1F:42 wlan0 My HW: AP= Acorp w422g Nokia E90 v 07.40.1.2 Ra-6 For attack...

Nokia e90/n82 (s60v3) - Remote Denial of Service

Nokia E90 and probably other devices with s60v3 crashes with aireplay The device should be authorised on an access point sample: aireplay-ng -0 10 -a 00:74:3B:0C:A0:5A -c 00:2A:29:F3:1F:42 wlan0 My HW: AP= Acorp w422g Nokia E90 v 07.40.1.2 Ra-6 For attack realisation is necessary to send DeAuth a...