CVE-2017-3831
Summary
| CVE | CVE-2017-3831 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-03-15 20:59:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. The vulnerability is due to improper implementation of authentication for accessing certain web pages using the GUI interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface of the affected system. A successful exploit could allow the attacker to bypass authentication and perform unauthorized configuration changes or issue control commands to the affected device. This vulnerability affects Cisco Mobility Express 1800 Series Access Points running a software version prior to 8.2.110.0. Cisco Bug IDs: CSCuy68219. |
Risk And Classification
Primary CVSS: v3.0 9.8 CRITICAL from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-264 | CWE-287 | CWE-264 Authentication Bypass Vulnerability CWE-264
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 10 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:L/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Cisco | Aironet 1810 | - | All | All | All |
| Hardware | Cisco | Aironet 1810w | - | All | All | All |
| Hardware | Cisco | Aironet 1815i | - | All | All | All |
| Hardware | Cisco | Aironet 1830e | - | All | All | All |
| Hardware | Cisco | Aironet 1830i | - | All | All | All |
| Hardware | Cisco | Aironet 1850e | - | All | All | All |
| Hardware | Cisco | Aironet 1850i | - | All | All | All |
| Operating System | Cisco | Aironet Access Point Software | 8.1\(112.3\) | All | All | All |
| Operating System | Cisco | Aironet Access Point Software | 8.1\(112.4\) | All | All | All |
| Operating System | Cisco | Aironet Access Point Software | 8.1\(131.0\) | All | All | All |
| Operating System | Cisco | Aironet Access Point Software | 8.1\(15.14\) | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | Cisco Mobility Express 1800 Access Point Series | affected Cisco Mobility Express 1800 Access Point Series | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco Mobility Express 1800 Access Point Series Authentication Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| Cisco Mobility Express 1800 Access Point Series CVE-2017-3831 Authentication Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.