Security Advisory 0097

Security Advisory 0097 PDF Date: May 24, 2024 Revision | Date | Changes ---|---|--- 1.0 | May 24, 2024 | Initial release The CVE-ID tracking this issue: CVE-2023-52424 CVSSv3.1 Base Score: Not indicated by NVD as of 5/23/2024 Description Arista Networks is providing this security update in respon...

The vulnerability of the IEEE 802.11 Wi-Fi standard lies in the insufficient protection of service data during the processing of SSID identifiers. This allows attackers to intercept traffic by replacing the access points.

The vulnerability of the IEEE 802.11 Wi-Fi standard lies in the insufficient protection of service data during the processing of SSID identifiers. Exploiting this vulnerability allows a malicious actor to intercept traffic by replacing the access points...

The vulnerability of Tp-Link AC1350 and Tp-Link N300 wireless access points’ microprogramming software is related to buffer overflow in the stack, allowing attackers to execute arbitrary code.

The vulnerability of the microprogrammed wireless access point software Tp-Link AC1350 and Tp-Link N300 lies in the buffer overflow that occurs during the processing of the ssid parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through specially crafted...

PT-2024-25285 · Aruba · Aruba Access Point

Name of the Vulnerable Software and Affected Versions: Aruba access points affected versions not specified Description: There is a buffer overflow vulnerability in the underlying Automatic Reporting service that could lead to unauthenticated remote code execution by sending specially crafted...

D-Link DAP-2310和DAP-2330 安全漏洞

D-Link DAP-2310 and DAP-2330 are both products of China AUO D-Link.DAP-2310 is a single-band wireless network access point for small businesses or schools that need a fast and reliable wireless network.DAP-2330 is a wireless N300 single-band PoE access point. Provides reliable, high-speed wireles...

The vulnerability of the TP-Link Device Debug protocol implementation in the microprogramming software for wireless access points Tp-Link AC1350 and Tp-Link N300 allows a hacker to cause service failure.

The vulnerability of the TP-Link Device Debug protocol implemented in the microsoftware for wireless access points Tp-Link AC1350 and Tp-Link N300 is related to the use of dangerous methods or functions. Exploiting this vulnerability can allow a malicious actor to cause service failures by sendin...

The vulnerability of microprogramming software in Cisco Aironet Access Points of models 1540, 1560, 1800, 2800, 3800, 4800, Catalyst 9105AX, Catalyst 9115, Catalyst 9120AX, Catalyst 9124AX, Catalyst 9130AX, and Catalyst 9136 allows attackers to bypass security restrictions, execute arbitrary commands, and download modified versions of the software.

The vulnerability of microprogrammed software on Cisco Aironet Access Points of models 1540, 1560, 1800, 2800, 3800, 4800, Catalyst 9105AX, Catalyst 9115, Catalyst 9120AX, Catalyst 9124AX, Catalyst 9130AX, and Catalyst 9136 is related to the exploitation of trusted boundaries. Exploiting this...

CVE-2024-31944

Cross-Site Request Forgery CSRF vulnerability in Octolize WooCommerce UPS Shipping – Live Rates and Access Points.This issue affects WooCommerce UPS Shipping – Live Rates and Access Points: from n/a through 2.2.4...

CVE-2024-31944 WordPress WooCommerce UPS Shipping plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Octolize WooCommerce UPS Shipping – Live Rates and Access Points.This issue affects WooCommerce UPS Shipping – Live Rates and Access Points: from n/a through 2.2.4...

WordPress WooCommerce UPS Shipping plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin WooCommerce UPS Shipping – Live Rates and Access Points versions = 2.2.4...

CVE-2023-49134

The CVE-2023-49134 entry is associated with TP-Link AC1350 (EAP225 V3) and N300 (EAP115 V4) devices and is substantiated by TALOS-2023-1862. A command-execution vulnerability exists in the tddpd enable_test_mode function. When the TDDP service (UDP-based) is accessible during the initial runtime ...

CVE-2023-49134

A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...

Cisco Access Points Managed from Catalyst DoS (cisco-sa-ap-dos-h9TGGX6W)

According to its self-reported version, Cisco access points managed by this Cisco Catalyst 9800 Series Wireless Controller are affected by a denial of service vulnerability. Due to insufficient input validation of certain IPv4 packets, an unauthenticated, remote attacker can causing attached acce...

Cisco Access Points Managed from WLC DoS (cisco-sa-ap-dos-h9TGGX6W)

According to its self-reported version, Cisco access points managed by this Cisco Wireless LAN Controller are affected by a denial of service vulnerability. Due to insufficient input validation of certain IPv4 packets, an unauthenticated, remote attacker can causing attached access points to relo...

PT-2024-21460 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions = 6.7.4 Description: The issue is related to the wifi mac80211 component in the Linux kernel, where some access points APs have ECSA elements stuck in their probe response. This causes the kernel to not attempt to connec...

CVE-2024-20303

A vulnerability in the multicast DNS mDNS gateway feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. This vulnerability is due to improper management of mDNS client entries. An attacker...

CVE-2024-20303

A vulnerability in the multicast DNS mDNS gateway feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. This vulnerability is due to improper management of mDNS client entries. An attacker...

PT-2024-2417 · Cisco · Cisco Aironet Access Points +2

Name of the Vulnerable Software and Affected Versions: Cisco Access Point AP Software affected versions not specified Cisco Aironet Access Points AP affected versions not specified Cisco Wireless LAN Controller WLC affected versions not specified Description: A vulnerability in the IP packet...

CVE-2024-2197

The Chirp Access app contains a hard-coded password, BEACONPASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetooth beacon, effectively disabling the application's ability to notify users when they are near a Beacon-enabled access point. This variable...

The vulnerability in the web interface for managing microprogrammed software on Cisco Small Business 100, 300, 500 Series Wireless Access Points allows a hacker to execute arbitrary code with root user privileges.

The vulnerability of the web interface for managing microprogrammed software on Cisco Small Business 100, 300, 500 Series Wireless Access Points is related to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root user privileges...