CVE Feed

    Dashboard / CVE / CVE-2012-5992

    CVE-2012-5992

    Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via screens/aaa/mgmtuser_create.html or (2) insert XSS sequences via the headline parameter to screens/base/web_auth_custom.html, aka Bug ID CSCud50283.

    Published:Dec 19, 2012
    Last Modified:Apr 11, 2025
    EPS:Dec 19, 2012
    EPSS Score:0.00592
    CVSS Score:6.8

    Affected Products

    Vendor
    Cisco
    Product
    2000 Wireless Lan Controller
    Vendor
    Cisco
    Product
    2100 Wireless Lan Controller
    Vendor
    Cisco
    Product
    2500 Wireless Lan Controller
    Vendor
    Cisco
    Product
    4100 Wireless Lan Controller
    Vendor
    Cisco
    Product
    4400 Wireless Lan Controller
    Vendor
    Cisco
    Product
    5500 Wireless Lan Controller
    Vendor
    Cisco
    Product
    7500 Wireless Lan Controller
    Vendor
    Cisco
    Product
    8500 Wireless Lan Controller
    Vendor
    Cisco
    Product
    Wireless Lan Controller Software

    Exploits

    http://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.htmlhttp://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.htmlhttps://www.exploit-db.com/exploits/23361

    Related CVEs

    CVE-2013-1235 (CVSS 5) — Cisco Wireless LAN Controller (WLC) devices do not properly address the resource consumption of terminated TEL…
    CVE-2013-1104 (CVSS 9) — The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows…
    CVE-2013-1105 (CVSS 9) — Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, …
    CVE-2013-1102 (CVSS 7.8) — The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with …
    CVE-2013-1103 (CVSS 7.8) — Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 b…
    CVE-2012-6007 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html on Cisco Wireless LAN Controller…
    CVE-2012-5991 (CVSS 6.3) — screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow…
    CVE-2012-0369 (CVSS 7.8) — Cisco Wireless LAN Controller (WLC) devices with software 6.0 and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, a…
    CVE-2012-0370 (CVSS 7.8) — Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.0 and 7.1 befo…
    CVE-2012-0371 (CVSS 9.3) — Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.4, when CPU-ba…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High