HIGH · 7.4

CVE-2021-34740

A vulnerability in the WLAN Control Protocol (WCP) implementation for Cisco Aironet Access Point (AP) software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device...

Vulnerability Description

A vulnerability in the WLAN Control Protocol (WCP) implementation for Cisco Aironet Access Point (AP) software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect error handling when an affected device receives an unexpected 802.11 frame. An attacker could exploit this vulnerability by sending certain 802.11 frames over the wireless network to an interface on an affected AP. A successful exploit could allow the attacker to cause a packet buffer leak. This could eventually result in buffer allocation failures, which would trigger a reload of the affected device.

CVSS Score

7.4

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
CiscoAironet Access Point Software>= 8.10.0, < 8.10.162.0
Cisco1100-4G\/6G Integrated Services Router-
Cisco1100-4P Integrated Services Router-
Cisco1100-8P Integrated Services Router-
Cisco1100 Integrated Services Router-
Cisco1101-4P Integrated Services Router-
Cisco1101 Integrated Services Router-
Cisco1109-2P Integrated Services Router-
Cisco1109-4P Integrated Services Router-
Cisco1109 Integrated Services Router-
Cisco1111X-8P Integrated Services Router-
Cisco1111X Integrated Services Router-
Cisco111X Integrated Services Router-
Cisco1120 Integrated Services Router-
Cisco1160 Integrated Services Router-
Cisco6300 Series Access Points-
CiscoAironet 1540-
CiscoAironet 1542D-
CiscoAironet 1542I-
CiscoAironet 1560-

Related Weaknesses (CWE)

References

FAQ

What is CVE-2021-34740?

CVE-2021-34740 is a vulnerability with a CVSS score of 7.4 (HIGH). A vulnerability in the WLAN Control Protocol (WCP) implementation for Cisco Aironet Access Point (AP) software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device...

How severe is CVE-2021-34740?

CVE-2021-34740 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-34740?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Aironet Access Point Software, Cisco 1100-4G\/6G Integrated Services Router, Cisco 1100-4P Integrated Services Router, Cisco 1100-8P Integrated Services Router, Cisco 1100 Integrated Services Router.