A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition.

This vulnerability is due to improper memory management. An attacker could exploit this vulnerability by sending a series of network requests to an affected device. A successful exploit could allow the attacker to cause the wncd process to consume available memory and eventually cause the device to reload, resulting in a DoS condition.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00078.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco IOS XE Software affected
Version Status Constraints
17.10.1 affected —
17.10.1a affected —
17.10.1b affected —
17.9.1 affected —
17.9.1w affected —
17.9.2 affected —
17.9.1a affected —
17.9.1x affected —
17.9.1y affected —
17.9.2a affected —
17.9.1x1 affected —

Configuration 1 [-]

AND
OR cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.9.2b:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:catalyst_9105i:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9105w:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9115:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9120:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9124d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9124e:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9124i:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9130:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9136:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9162:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9164:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9166:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9166d1:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_iw6300:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:esw6300:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:iw9167eh-x-ap:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:iw9167eh-x-urwb:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:iw9167eh-x-wgb:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:iw9167ih-x-ap:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
Catalyst 9105i Subscribe
Catalyst 9105w Subscribe
Catalyst 9115 Subscribe
Catalyst 9120 Subscribe
Catalyst 9124d Subscribe
Catalyst 9124e Subscribe
Catalyst 9124i Subscribe
Catalyst 9130 Subscribe
Catalyst 9136 Subscribe
Catalyst 9162 Subscribe
Catalyst 9164 Subscribe
Catalyst 9166 Subscribe
Catalyst 9166d1 Subscribe
Catalyst 9800-40 Subscribe
Catalyst 9800-80 Subscribe
Catalyst 9800-cl Subscribe
Catalyst 9800-l Subscribe
Catalyst Iw6300 Subscribe
Esw6300 Subscribe
Ios Xe Subscribe
Iw9167eh-x-ap Subscribe
Iw9167eh-x-urwb Subscribe
Iw9167eh-x-wgb Subscribe
Iw9167ih-x-ap Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-24381 A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper memory management. An attacker could exploit this vulnerability by sending a series of network requests to an affected device. A successful exploit could allow the attacker to cause the wncd process to consume available memory and eventually cause the device to reload, resulting in a DoS condition.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-wncd-HFGMsfSD cve-icon cve-icon
History

Thu, 21 Nov 2024 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2024-11-21T21:43:32.060Z

Reserved: 2022-10-27T18:47:50.367Z

Link: CVE-2023-20202

cve-icon Vulnrichment

Updated: 2024-08-02T09:05:35.862Z

cve-icon NVD

Status : Modified

Published: 2023-09-27T18:15:11.177

Modified: 2024-11-21T07:40:49.307

Link: CVE-2023-20202

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses