Details of VAR-201711-0353

ID

VAR-201711-0353

CVE

CVE-2017-12283

TITLE

Cisco Aironet 3800 Series access point buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-009870

DESCRIPTION

A vulnerability in the handling of 802.11w Protected Management Frames (PAF) by Cisco Aironet 3800 Series Access Points could allow an unauthenticated, adjacent attacker to terminate a valid user connection to an affected device, aka Denial of Service. The vulnerability exists because the affected device does not properly validate 802.11w PAF disassociation and deauthentication frames that it receives. An attacker could exploit this vulnerability by sending a spoofed 802.11w PAF frame from a valid, authenticated client on an adjacent network to an affected device. A successful exploit could allow the attacker to terminate a single valid user connection to the affected device. This vulnerability affects Access Points that are configured to run in FlexConnect mode. Cisco Bug IDs: CSCvc20627. Vendors have confirmed this vulnerability Bug ID CSCvc20627 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. 802.11wProtectedManagementFrames (PAF) is one of the frame encryption protection components. Attackers can exploit this issue to cause a denial-of-service condition, denying service to legitimate users

Trust: 2.52

sources: NVD: CVE-2017-12283 // JVNDB: JVNDB-2017-009870 // CNVD: CNVD-2017-32927 // BID: 101645 // VULHUB: VHN-102790

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-32927

AFFECTED PRODUCTS

vendor:	cisco	model:	aironet 3800	scope:	eq	version:	-	Trust: 1.6
vendor:	cisco	model:	aironet 3800 series	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	aironet series access point	scope:	eq	version:	3800	Trust: 0.6
vendor:	cisco	model:	aironet series access points	scope:	eq	version:	38000	Trust: 0.3
vendor:	cisco	model:	aironet series access points	scope:	eq	version:	18508.4(1.127)	Trust: 0.3

sources: CNVD: CNVD-2017-32927 // BID: 101645 // JVNDB: JVNDB-2017-009870 // CNNVD: CNNVD-201711-070 // NVD: CVE-2017-12283

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-12283
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-12283
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2017-32927
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-201711-070
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-102790
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2017-12283
severity:	LOW
baseScore:	2.9
vectorString:	AV:A/AC:M/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-32927
severity:	LOW
baseScore:	2.7
vectorString:	AV:A/AC:L/AU:S/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-102790
severity:	LOW
baseScore:	2.9
vectorString:	AV:A/AC:M/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-12283
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.6
impactScore:	4.0
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-32927 // VULHUB: VHN-102790 // JVNDB: JVNDB-2017-009870 // CNNVD: CNNVD-201711-070 // NVD: CVE-2017-12283

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-102790 // JVNDB: JVNDB-2017-009870 // NVD: CVE-2017-12283

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201711-070

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201711-070

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-009870

PATCH

title:	cisco-sa-20171101-aironet4	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-aironet4	Trust: 0.8
title:	Patch for CiscoAironet3800SeriesAccessPoints Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/105514	Trust: 0.6
title:	Cisco Aironet 3800 Series Access Points Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76075	Trust: 0.6

sources: CNVD: CNVD-2017-32927 // JVNDB: JVNDB-2017-009870 // CNNVD: CNNVD-201711-070

EXTERNAL IDS

db:	NVD	id:	CVE-2017-12283	Trust: 3.4
db:	BID	id:	101645	Trust: 2.0
db:	SECTRACK	id:	1039718	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-009870	Trust: 0.8
db:	CNNVD	id:	CNNVD-201711-070	Trust: 0.7
db:	CNVD	id:	CNVD-2017-32927	Trust: 0.6
db:	VULHUB	id:	VHN-102790	Trust: 0.1

sources: CNVD: CNVD-2017-32927 // VULHUB: VHN-102790 // BID: 101645 // JVNDB: JVNDB-2017-009870 // CNNVD: CNNVD-201711-070 // NVD: CVE-2017-12283

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20171101-aironet4	Trust: 2.6
url:	http://www.securityfocus.com/bid/101645	Trust: 1.7
url:	http://www.securitytracker.com/id/1039718	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12283	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-12283	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2017-32927 // VULHUB: VHN-102790 // BID: 101645 // JVNDB: JVNDB-2017-009870 // CNNVD: CNNVD-201711-070 // NVD: CVE-2017-12283

CREDITS

Cisco

Trust: 0.3

sources: BID: 101645

SOURCES

db:	CNVD	id:	CNVD-2017-32927
db:	VULHUB	id:	VHN-102790
db:	BID	id:	101645
db:	JVNDB	id:	JVNDB-2017-009870
db:	CNNVD	id:	CNNVD-201711-070
db:	NVD	id:	CVE-2017-12283

LAST UPDATE DATE

2025-04-20T23:22:09.153000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-32927	date:	2017-11-07T00:00:00
db:	VULHUB	id:	VHN-102790	date:	2019-10-09T00:00:00
db:	BID	id:	101645	date:	2017-12-19T22:36:00
db:	JVNDB	id:	JVNDB-2017-009870	date:	2017-11-24T00:00:00
db:	CNNVD	id:	CNNVD-201711-070	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-12283	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-32927	date:	2017-11-07T00:00:00
db:	VULHUB	id:	VHN-102790	date:	2017-11-02T00:00:00
db:	BID	id:	101645	date:	2017-11-01T00:00:00
db:	JVNDB	id:	JVNDB-2017-009870	date:	2017-11-24T00:00:00
db:	CNNVD	id:	CNNVD-201711-070	date:	2017-11-03T00:00:00
db:	NVD	id:	CVE-2017-12283	date:	2017-11-02T16:29:00.677