CVE-2018-0235 / Cisco CISCO-SA-20180502-WLC-MFDOS: n/a Cisco Wireless LAN Controller: Improper Input Validation

Recommended actionWithin 7 days

High technical severity; prioritise exposed affected systems while verifying vendor guidance.

Fix not verified

What, why and how

A vulnerability in the 802.11 frame validation functionality of the Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of certain 802.11 management information element frames that an affected device receives from wireless clients. An attacker could exploit this vulnerability by sending a malformed 802.11 management frame to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. This vulnerability affects only Cisco Wireless LAN Controllers that are running Cisco Mobility Express Release 8.5.103.0. Cisco Bug IDs: CSCvg07024.

What

Why

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

How

An attacker operating through the affected interface may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.

What

Why

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

How

An attacker operating through the affected interface may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: the affected interface → Improper Input Validation → disrupt the affected service
Attack surface: Unspecified
Privileges required: None: unauthenticated exploitation is possible
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Changed: exploitation can affect a different security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-20 ↗
CWE-20: Improper Input Validation. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVAdjacentAttack vector: The attacker must be on an adjacent or logically close network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SChangedScope: The attack can affect a component governed by a different security authority.CNoneConfidentiality impact: No direct loss is represented by this metric.INoneIntegrity impact: No direct loss is represented by this metric.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.

UnauthenticatedDenial of serviceCWE-20

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2018-1058Official EUVD mapping

0 linked advisory records.

Official EUVD record ↗

Canadian Centre for Cyber Security · English · AV18-073Cisco security updates

ability - Cisco Firepower System Software Transport Layer Security Extensions Denial of Service Vulnerability - Cisco Firepower System Software Cross-Origin Domain Protection Vulnerability - Cisco Firepower System Software Transport Layer Security Denial of Service Vulnerability - Cisco Aironet Access Points Central Web Authentication FlexConnect Client ACL Bypass Vulnerability - Cisco Aironet 1800 Series Access Point 802.11 Denial of Service Vulnerability - Cisco Wireless LAN Controller and Aironet Access Points IOS WebAuth Client Authentication Bypass Vulnerability CVE References: CVE-2018-0167, CVE-2018-0175, CVE-2018-0226, CVE-2018-0234, CVE-2018-0235, CVE-2018-0245, CVE-2018-0247, CVE-2018-0249, CVE-2018-0250, CVE-2018-0252, CVE-2018-0253, CVE-2018-0258, CVE-2018-0262, CVE-2018-0264, CVE-2018-0278, CVE-2018-0281, CVE-2018-0283, CVE-2018-0285, CVE-2018-0286, CVE-2018-0287, CVE-2018-0288 Suggested Action CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly. References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-war https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-prime-upload https://tools.cisco.com/security/center/content/CiscoSecurity

Official advisory ↗

CERT-FR · French · CERTFR-2018-AVI-211Multiples vulnérabilités dans les produits Cisco

De multiples vulnérabilités ont été découvertes dans les produits Cisco . Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Official advisory ↗

JVN iPedia · Japanese · JVNDB-2018-004907Cisco Wireless LAN Controller における脆弱性

Cisco Wireless LAN Controller (WLC) には、不特定の脆弱性が存在します。ベンダは、本脆弱性を Bug ID CSCvg07024 として公開しています。

Official advisory ↗

KISA KrCERT/CC · Korean · KNVD-4873Cisco 제품군 취약점 보안 업데이트 권고

#### Cisco 제품군 취약점 보안 업데이트 권고 2018.05.09 ##### □ 개요 o Cisco社는 자사 제품에 대해 다수의 취약점을 해결한 보안 업데이트를 공지 o 공격자는 해당 취약점을 이용하여 피해를 발생시킬 수 있어 해당 Cisco 제품을 사용하는 이용자들은 최신 버전으로 업데이트할 것을 권고 ##### □ 주요 내용 o Cisco Aironet 1800, 2800 및 3800 시리즈의 Secure Shell(SSH)에서 기본 계정을 사용하여 발생하는 권한 상승 취약점 (CVE-2018-0226) [1] o Cisco Aironet 1810, 1830 및 1850 시리즈의 Point-to-Point Protocol(PPTP)에서 발생하는 서비스 거부 취약점 (CVE-2018-0234) [2] o Cisco Wireless LAN Controller(WLC)의 802.11 프레임의 유효성 검사 기능에서 발생하는 서비스 거부 취약점 (CVE-2018-0235) [3] o Cisco Wireless LAN Controller 소프트웨어의 IPv4 패킷을 재조립하는 과정에서 발생하는 서비스 거부 취약점 (CVE-2018-0252) [4] o Cisco Secure Access Control System(ACS)의 리포트 구성에서 발생하는 원격 코드 실행 취약점(CVE-2018-0253) [5] o Cisco Prime File Upload 서블릿에서 발생하는 경로 탐색 및 원격 코드 실행 취약점(CVE-2018-0258) [6] o Cisco Meeting Server에서 발생하는 원격 코드 실행 취약점(CVE-2018-0262) [8] o Cisco WebEx 네트워크 레코딩 플레이어에서 사용 중인 Advanced Recording Format(ARF)에서 발생하는 원격 코드 실행 취약점(CVE-2018-0264) ##### □ 영향을 받는 시스템 o 참고사이트에 명시되어 있는 ‘Affected Products’을 통해 취약한 제품 확인 ##### □ 해결 방안 o 취약점이 발생한 Cisco 소프트웨어가 설치된 Cisco장비의 운영자는 해당사이트에 명시되어 있는 ‘Affected Products’ 내용을 확인하여 패치 적용 ##### □ 기타 문의사항 o 한국인터넷진흥원 인터넷침해대응센터: 국번없이

Official advisory ↗

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Fix not verified
Affected: Cisco Wireless LAN Controller: Cisco Wireless LAN Controller
Fixed: No fixed version is explicitly recorded in the structured CVE data.
Action: No verified patch reference is present in the current structured sources. Check the vendor advisory before making a change.
Workaround: No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.

Evidence and provenance

Published 2 May 2018 · Last source change 29 Nov 2024, 15:13 UTC · CWE-20 · Improper Input Validation

CVE recordCVE.org · 5.1

CVSS sourceNIST NVD

EPSS source

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-09-01

European sourceENISA EUVD · EUVD-2018-1058

Product sourceCNA

Remediation sourceCVE/CNA references

CWE sourceCNA

NVD statusNVD modified after enrichment

Missing structured fields: affected product. Missing data is not evidence of low risk; review the primary advisory.

Material change intelligence

What changed after publication

View recent updates ↗

1 Sep 2026, 02:42 UTC
ENISA EUVD mappingEUVD-2018-1058 was added to the official ENISA EUVD mapping for this CVE.
Before
not recorded
After
{"euvdId":"EUVD-2018-1058"}
ENISA EUVD ↗
29 Nov 2024, 15:13 UTC
Vendor guidanceAuthoritative vendor guidance changed: added vendor advisory: tools.cisco.com/cisco-sa-20180502-wlc-mfdos.
Before
no authoritative guidance recorded
After
vendor advisory: tools.cisco.com/cisco-sa-20180502-wlc-mfdos
tools.cisco.com ↗
29 Nov 2024, 15:13 UTC
SeveritySeverity changed from Unknown to High.
Before
Unknown
After
High
NIST NVD ↗
29 Nov 2024, 15:13 UTC
CVSS scoreCVSS score changed from not recorded to 7.4 (CVSS 3.1 · NIST NVD · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
Before
not recorded
After
7.4 (CVSS 3.1 · NIST NVD · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
NIST NVD ↗
29 Nov 2024, 15:13 UTC
Catalogue recordCVE added to the BlackTree catalogue.
CNA ↗

2018-05-02CVE published

ENISA EUVD · EUVD-2018-1058↗CVE authority or vendor reference · Cisco CISCO-SA-20180502-WLC-MFDOS↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.

n/a Cisco Wireless LAN Controller: Improper Input Validation

Published severity in operational context

Evidence used

Compensating controls

Verification

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

ENISA European Vulnerability Database

EUVD-2018-1058

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

What changed after publication