CVE-2018-15395 (CNNVD-201810-993)
中文标题:
Cisco Wireless LAN Controller Software 安全漏洞
英文标题:
Cisco Wireless LAN Controller Software Privilege Escalation Vulnerability
漏洞描述
中文描述:
Cisco Wireless LAN Controller（WLC）Software是美国思科（Cisco）公司的一套用于配置和管理WLC（无线局域网控制器）的软件。 Cisco WLC Software中的身份验证和授权检查机制存在安全漏洞。物理位置邻近的攻击者可利用该漏洞获取对Cisco TrustSec域的网络访问权限。
英文描述:
A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, adjacent attacker to gain network access to a Cisco TrustSec domain. Under normal circumstances, this access should be prohibited. The vulnerability is due to the dynamic assignment of Security Group Tags (SGTs) during a wireless roam from one Service Set Identifier (SSID) to another within the Cisco TrustSec domain. An attacker could exploit this vulnerability by attempting to acquire an SGT from other SSIDs within the domain. Successful exploitation could allow the attacker to gain privileged network access that should be prohibited under normal circumstances.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco Wireless LAN Controller (WLC) | n/a | - | - |
cpe:2.3:a:cisco:cisco_wireless_lan_controller_(wlc):n_a:*:*:*:*:*:*:*
|
| cisco | wireless_lan_controller_software | 8.5\(120.0\) | - | - |
cpe:2.3:o:cisco:wireless_lan_controller_software:8.5\(120.0\):*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.0 (cna)
MEDIUMCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2018-15395 |
2025-11-11 15:19:41 | 2025-11-11 07:35:07 |
| NVD | nvd_CVE-2018-15395 |
2025-11-11 14:55:59 | 2025-11-11 07:43:41 |
| CNNVD | cnnvd_CNNVD-201810-993 |
2025-11-11 15:10:06 | 2025-11-11 07:54:05 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201810-993
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']