Cisco wireless vulnerability

[hillstom628]

Hey all,

I was just browsing around a bit and i stumbled onto this little exploit in the lightweight access-points.

If you have a Wireless LAN Controller (WLC) the LW-AP's will broadcast unencrypted information about the WLC. This enables the hacker to set up a rogue AP's troughout the network. This is a security risk because then the hacker can sniff all the traffic going trough the network.

192.168.10.1 

[patoberli]

I'm not entirely sure what you mean.

Do you mean the CAPWAP traffic between the AP and the WLC on the LAN cable? That traffic is by default unencrypted, like all other PC attached to a switch traffic. You can enable DTLS to encrypt this traffic, if this is a concern for you.

Also the WLC IP address is no secret, as it's in the DHCP packets in every packet in the AP VLAN. 

[Rich R]

What is the specific vulnerability you are referring to?

What WLC model?

What AP model(s)?

What version of code (AireOS or IOS-XE) are you running?

What exactly is your question about the vulnerability?

Like @patoberli already said there is a lot of info available by default - that's not a vulnerability, it's by design.  There are a whole lot of things you should do to design a secure network - many different aspects to network security which is multi-layered.

Serious vulnerabilities in the code will always be fixed by Cisco although it can take a few months for them to release fixed code.

Then it's up to you to upgrade your controllers and APs.

Note that end of life models do not get these fixes so you run that equipment at your own risk.