Cisco Wireless Control System (WCS) Unspecified SQL Injection Vulnerability

Bugtraq ID:	42368
Class:	Input Validation Error
CVE:	CVE-2010-2826
Remote:	Yes
Local:	No
Published:	Aug 11 2010 12:00AM
Updated:	Aug 11 2010 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Wireless Control System 6.0.181.0
Not Vulnerable:	Cisco Wireless Control System 7.0.164

Cisco Wireless Control System (WCS) Unspecified SQL Injection Vulnerability

Cisco Wireless Control System (WCS) is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an authenticated attacker to compromise the affected device, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue is tracked by Cisco Bug ID CSCtf37019.

Cisco Wireless Control System 6.0.x are vulnerable.

Cisco Wireless Control System (WCS) Unspecified SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

Cisco Wireless Control System (WCS) Unspecified SQL Injection Vulnerability

Solution:
An update is available. Please see the references for more information.

Cisco Wireless Control System (WCS) Unspecified SQL Injection Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Wireless Control System Product Page (Cisco)
  
• Cisco Security Advisory: SQL Injection Vulnerability in Cisco Wireless Control S (Cisco)