CVE-2019-15266

Medium

Description

A vulnerability in the CLI of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to view system files that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in command-line parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files that may contain sensitive information.

SeverityMedium

CVSS4.4

Exploit probability—

Product

Cisco Wireless Lan Controller Software

PublishedOct 16, 2019

First seenOct 16, 2019

Weakness typeCWE-22Path traversal

How to fix

Update

cisco wireless_lan_controller_software8.10 or later

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-wlc-pathtrav

Affected products

Product	Affected versions	Fixed in
cisco wireless_lan_controller_software	v < 8.10	8.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.