TI-2018-00376 Aliases CVE-2018-0417 GHSA-ghg7-vhxc-mhv7

Cisco Wireless LAN Controller Software GUI Privilege Escalation Vulnerability

MEDIUM 42CWE-264Published 2018-10-17 · Updated 2024-11-26

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

A vulnerability in TACACS authentication with Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to perform certain operations within the GUI that are not normally available to that user on the CLI. The vulnerability is due to incorrect parsing of a specific TACACS attribute received in the TACACS response from the remote TACACS server. An attacker could exploit this vulnerability by authenticating via TACACS to the GUI on the affected device. A successful exploit could allow an attacker to create local user accounts with administrative privileges on an affected WLC and execute other commands that are not allowed from the CLI and should be prohibited.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.03163 88th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco Wireless LAN Controller (WLC)	all versions	—	No fix listed	CNA

Cisco Wireless LAN Controller (WLC) VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:wireless_lan_controller_software:8.7\(1.115\):::::::*	8.7(1.115)	Vulnerable	Cisco
cpe:2.3:o:cisco:wireless_lan_controller::::::::	8.4 to before 8.5.131.0	Vulnerable	Cisco
cpe:2.3:o:cisco:wireless_lan_controller_software::::::::	before 8.2.170.0; 8.6 to before 8.7.102.0	Vulnerable	Cisco

cpe:2.3:o:cisco:wireless_lan_controller_software:8.7\(1.115\):*:*:*:*:*:*:* Versions 8.7(1.115) Vulnerable ·Cisco
cpe:2.3:o:cisco:wireless_lan_controller:*:*:*:*:*:*:*:* Versions 8.4 to before 8.5.131.0 Vulnerable ·Cisco
cpe:2.3:o:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:* Versions before 8.2.170.0; 8.6 to before 8.7.102.0 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-0417
2026-10-03 Alias added: GHSA-ghg7-vhxc-mhv7

References

Advisory 1

20181017 Cisco Wireless LAN Controller Software GUI Privilege Escalation Vulnerability

TI-2014-00660 Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS… CVSS 2.0HIGH 10.0
TI-2020-03104 Cisco Aironet Access Points UDP Flooding Denial of Service Vulnerability CVSS 3.1HIGH 8.6
TI-2020-03103 Cisco Aironet Access Point Authentication Flood Denial of Service Vulnerability CVSS 3.1HIGH 8.6
TI-2014-00664 Cisco Wireless LAN Controller (WLC) devices 7.2, 7.3, and 7.4 before 7.4.110.0 allow… CVSS 2.0HIGH 7.8
TI-2014-00663 Cisco Wireless LAN Controller (WLC) devices 7.2 before 7.2.115.2, 7.3, and 7.4 before… CVSS 2.0HIGH 7.8
TI-2014-00662 The multicast listener discovery (MLD) service on Cisco Wireless LAN Controller (WLC)… CVSS 2.0HIGH 7.1

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences