CVE-2019-15276: high-severity vulnerability in Cisco Wireless LAN Controller (WLC)
Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability
Published · Updated
53Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.7epss 46%
from disclosure to weapon8 days
Published on NVDNov 26
1st PoC+8d
exploitation probability
46%top 1% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially crafted URLs. An attacker could exploit this vulnerability by authenticating with low privileges to an affected controller and submitting the crafted URL to the web interface of the affected device. Conversely, an unauthenticated attacker could exploit this vulnerability by persuading a user of the web interface to click the crafted URL. A successful exploit could allow the attacker to cause an unexpected restart of the device, resulting in a DoS condition.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Affected products
Cisco · Cisco Wireless LAN Controller (WLC)public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/47744unverifiedcve_referencepacketstormsecurity.com/files/155554/Cisco-WLC-2504-8.9-Denial-Of-Service.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Wireless LAN Controller (WLC)
In the same product, most dangerous first.
CVE-2022-20695CRITICALCisco Wireless LAN Controller Management Interface Authentication Bypass VulnerabilityEPSS 19.8%CVE-2018-0420MEDIUMCisco Wireless LAN Controller Software Directory Traversal VulnerabilityEPSS 4.6%CVE-2018-0443HIGHCisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Denial of Service VulnerabilityEPSS 3.4%CVE-2018-0442HIGHCisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure VulnerabilityEPSS 3.3%CVE-2018-0417HIGHCisco Wireless LAN Controller Software GUI Privilege Escalation VulnerabilityEPSS 3.2%CVE-2018-0416MEDIUMCisco Wireless LAN Controller Software Information Disclosure VulnerabilityEPSS 2.5%