Critical Cisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability
A vulnerability in the authentication functionality of Cisco Wireless
LAN Controller (WLC) Software could allow an unauthenticated, remote
attacker to bypass authentication controls and log in to the device
through the management interface
This vulnerability is due to the improper implementation of the
password validation algorithm. An attacker could exploit this
vulnerability by logging in to an affected device with crafted
credentials. A successful exploit could allow the attacker to bypass
authentication and log in to the device as an administrator. The
attacker could obtain privileges that are the same level as an
administrative user but it depends on the crafted credentials.
Note: This vulnerability exists because of a
non-default device configuration that must be present for it to be
exploitable. For details about the vulnerable configuration, see the Vulnerable Products section of this advisory.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
This vulnerability affects the following Cisco products if they are
running Cisco WLC Software Release 184.108.40.206 or Release 220.127.116.11 and
have macfilter radius compatibility configured as Other:
3504 Wireless Controller
5520 Wireless Controller
8540 Wireless Controller
Virtual Wireless Controller (vWLC)
Note: The vulnerable releases noted above are available in the Software Center
on Cisco.com. In addition, specific customers have been given the
following vulnerable escalation builds that are not in the Software
18.104.22.168 to 22.214.171.124
126.96.36.199 to 188.8.131.52
Determine the Configuration
To determine whether the Cisco WLC configuration is vulnerable, issue the show macfilter summary CLI command. If RADIUS compatibility mode is other, as shown in the following example, the device is considered vulnerable:
wlc > show macfilter summary
MAC Filter RADIUS Compatibility mode............. Other MAC Filter Delimiter............................. Single-Hyphen MAC Filter Entries............................... 0
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
Catalyst 9800 Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 Series Switches
Catalyst 9800 Series Wireless Controllers
Catalyst 9800 Wireless Controller for Cloud
Embedded Wireless Controller on Catalyst Access Points
There are workarounds that addresses this vulnerability. Choose one of the following based on the environment:
Option 1: No Macfilters in the Environment
Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command:
wlc > config macfilter radius-compat cisco
Option 2: Macfilters in the Environment
Customers who use macfilters and who are able to change the radius
server configuration to match other possible compatibility modes can
modify the macfilter compatibility to either cisco or free using one of the following CLI commands:
While these workarounds have been deployed and were proven successful
in a test environment, customers should determine the applicability and
effectiveness in their own environment and under their own use
conditions. Customers should be aware that any workaround or mitigation
that is implemented may negatively impact the functionality or
performance of their network based on intrinsic customer deployment
scenarios and limitations. Customers should not deploy any workarounds
or mitigations before first evaluating the applicability to their own
environment and any impact to such environment.
Cisco has released free software updates
that address the vulnerability described in this advisory. Customers
with service contracts that entitle them to regular software updates
should obtain security fixes through their usual update channels.
Additionally, customers may only download software for which they
have a valid license, procured from Cisco directly, or through a Cisco
authorized reseller or partner. In most cases this will be a maintenance
upgrade to software that was previously purchased. Free security
software updates do not entitle customers to a new software license,
additional software feature sets, or major revision upgrades.
The Cisco Support and Downloads page
on Cisco.com provides information about licensing and downloads. This
page can also display customer device support coverage for customers who
use the My Devices tool.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and
software configurations will continue to be supported properly by the
new release. If the information is not clear, customers are advised to
contact the Cisco Technical Assistance Center (TAC) or their contracted
Customers should have the product serial number available and be
prepared to provide the URL of this advisory as evidence of entitlement
to a free upgrade.
In the following table(s), the left column lists Cisco software
releases. The right column indicates whether a release is affected by
the vulnerability described in this advisory and the first release that
includes the fix for this vulnerability. Customers are advised to
upgrade to an appropriate fixed software release as indicated in this section.
Cisco Wireless LAN Controller Release
First Fixed Release
8.9 and earlier
184.108.40.206 and earlier
220.127.116.11 and later
To download the software from the Software Center on Cisco.com, do the following:
Click Browse all.
Choose Wireless > Wireless LAN Controller > Standalone Controllers.
Choose a specific product from the right pane of the product selector.
Choose a hardware platform from the left pane of the software page.
The Cisco Product Security Incident Response Team (PSIRT) validates
only the affected and fixed release information that is documented in
Exploitation and Public Announcements
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability that is described in this advisory.
Cisco would like to thank a security researcher with Bispok for reporting this vulnerability.