Sign-up

ID

VAR-200704-0024


CVE

CVE-2007-2040


TITLE

Cisco Aironet Vulnerable to arbitrary operations on devices

Trust: 0.8

sources: JVNDB: JVNDB-2007-001827

DESCRIPTION

Cisco Aironet 1000 Series and 1500 Series Lightweight Access Points before 3.2.185.0, and 4.0.x before 4.0.206.0, have a hard-coded password, which allows attackers with physical access to perform arbitrary actions on the device, aka Bug ID CSCsg15192. Cisco Wireless LAN Controller (WLC) is prone to multiple remote vulnerabilities, including an unauthorized-access vulnerability, an information-disclosure vulnerability, and a vulnerability that prevents the WLAN's ACLs from being installed. An attacker can exploit these issues to completely compromise the affected device, cause a denial-of-service condition, obtain potentially sensitive information, and gain unauthorized access to the affected device. Cisco Wireless LAN Controllers (WLCs) manage Cisco Aironet access points using the Lightweight Access Point Protocol (LWAPP). This service account is only accessible through a physical connection to the console port, but the password is the same for all devices in these families. This vulnerability is documented in Cisco Bug ID as CSCsg15192

Trust: 1.98

sources: NVD: CVE-2007-2040 // JVNDB: JVNDB-2007-001827 // BID: 23461 // VULHUB: VHN-25402

AFFECTED PRODUCTS

vendor:ciscomodel:wireless lan controller softwarescope:gteversion:3.2

Trust: 1.0

vendor:ciscomodel:wireless lan controller softwarescope:ltversion:3.2.185.0

Trust: 1.0

vendor:ciscomodel:wireless lan controller softwarescope:ltversion:4.0.206.0

Trust: 1.0

vendor:ciscomodel:wireless lan controller softwarescope:gteversion:4.0

Trust: 1.0

vendor:ciscomodel:aironet 350 seriesscope:eqversion:1000 series 1500 series lightweight access points

Trust: 0.8

vendor:ciscomodel:wireless lan controllerscope:ltversion:3.2.185.0

Trust: 0.8

vendor:ciscomodel:aironetscope:eqversion:1000-series

Trust: 0.6

vendor:ciscomodel:aironetscope:eqversion:1500-series

Trust: 0.6

vendor:ciscomodel:wireless lan controller modulescope:eqversion:0

Trust: 0.3

vendor:ciscomodel:catalyst series wireless services modulescope:eqversion:65000

Trust: 0.3

vendor:ciscomodel:catalyst series integrated wireless lan contscope:eqversion:37500

Trust: 0.3

vendor:ciscomodel:aironetscope:eqversion:1500

Trust: 0.3

vendor:ciscomodel:aironetscope:eqversion:1000

Trust: 0.3

vendor:ciscomodel:wireless lan controllerscope:eqversion:44000

Trust: 0.3

vendor:ciscomodel:wireless lan controllerscope:eqversion:41000

Trust: 0.3

vendor:ciscomodel:wireless lan controllerscope:eqversion:21000

Trust: 0.3

vendor:ciscomodel:wireless lan controllerscope:eqversion:20000

Trust: 0.3

vendor:ciscomodel:aironetscope:neversion:1400

Trust: 0.3

vendor:ciscomodel:aironetscope:neversion:1300

Trust: 0.3

vendor:ciscomodel:aironet 1240agscope:neversion: -

Trust: 0.3

vendor:ciscomodel:aironetscope:neversion:1200

Trust: 0.3

vendor:ciscomodel:aironet 1130agscope:neversion: -

Trust: 0.3

vendor:ciscomodel:aironetscope:neversion:1100

Trust: 0.3

vendor:ciscomodel:aironet 1230agscope:neversion: -

Trust: 0.3

sources: BID: 23461 // JVNDB: JVNDB-2007-001827 // NVD: CVE-2007-2040 // CNNVD: CNNVD-200704-265

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2007-2040
value: MEDIUM

Trust: 1.8

CNNVD: CNNVD-200704-265
value: MEDIUM

Trust: 0.6

VULHUB: VHN-25402
value: MEDIUM

Trust: 0.1

NVD:
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 1.9
impactScore: 10.0
acInsufInfo: FALSE
obtainAllPrivilege: TRUE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

NVD: CVE-2007-2040
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-25402
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 1.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-25402 // JVNDB: JVNDB-2007-001827 // NVD: CVE-2007-2040 // CNNVD: CNNVD-200704-265

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-2040

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-200704-265

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200704-265

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2007-2040

PATCH
title:cisco-sa-20070412-wlcurl:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20070412-wlc
Trust: 0.8
title:Cisco wireless Lan Controller light AP Fixes for hard-coded service password security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=96762
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2007-001827 // 
            
            
            
            CNNVD: CNNVD-200704-265

EXTERNAL IDS
db:NVDid:CVE-2007-2040
Trust: 2.8
db:BIDid:23461
Trust: 2.0
db:SECTRACKid:1017908
Trust: 1.7
db:OSVDBid:34133
Trust: 1.7
db:VUPENid:ADV-2007-1368
Trust: 1.7
db:JVNDBid:JVNDB-2007-001827
Trust: 0.8
db:CNNVDid:CNNVD-200704-265
Trust: 0.7
db:VULHUBid:VHN-25402
Trust: 0.1
sources:
            
            
            VULHUB: VHN-25402 // 
            
            
            
            BID: 23461 // 
            
            
            
            JVNDB: JVNDB-2007-001827 // 
            
            
            
            NVD: CVE-2007-2040 // 
            
            
            
            CNNVD: CNNVD-200704-265

REFERENCES
url:http://www.securityfocus.com/bid/23461
Trust: 1.7
url:http://www.cisco.com/warp/public/707/cisco-sa-20070412-wlc.shtml
Trust: 1.7
url:http://www.osvdb.org/34133
Trust: 1.7
url:http://securitytracker.com/id?1017908
Trust: 1.7
url:http://www.vupen.com/english/advisories/2007/1368
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/33610
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-2040
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-2040
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:/archive/1/465506
Trust: 0.3
url:http://www.cisco.com/en/us/products/products_security_advisory09186a008081e189.shtml
Trust: 0.3
sources:
            
            
            VULHUB: VHN-25402 // 
            
            
            
            BID: 23461 // 
            
            
            
            JVNDB: JVNDB-2007-001827 // 
            
            
            
            NVD: CVE-2007-2040 // 
            
            
            
            CNNVD: CNNVD-200704-265

CREDITS
Cisco Security bulletin
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200704-265

SOURCES
db:VULHUBid:VHN-25402
db:BIDid:23461
db:JVNDBid:JVNDB-2007-001827
db:NVDid:CVE-2007-2040
db:CNNVDid:CNNVD-200704-265

LAST UPDATE DATE
2023-12-18T12:23:38.665000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-25402date:2019-08-14T00:00:00
db:BIDid:23461date:2016-07-06T14:39:00
db:JVNDBid:JVNDB-2007-001827date:2012-06-26T00:00:00
db:NVDid:CVE-2007-2040date:2019-08-14T11:28:41.370
db:CNNVDid:CNNVD-200704-265date:2019-08-15T00:00:00

SOURCES RELEASE DATE
db:VULHUBid:VHN-25402date:2007-04-16T00:00:00
db:BIDid:23461date:2007-04-12T00:00:00
db:JVNDBid:JVNDB-2007-001827date:2012-06-26T00:00:00
db:NVDid:CVE-2007-2040date:2007-04-16T21:19:00
db:CNNVDid:CNNVD-200704-265date:2007-04-16T00:00:00