Read the docs
TI-2019-11375 Aliases CVE-2019-15261GHSA-3273-9gqr-v74w

Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service Vulnerability

Priority MEDIUM 46CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Generic Routing Encapsulation (GRE) frames that pass through the data plane of an affected AP. An attacker could exploit this vulnerability by associating to a vulnerable AP, initiating a PPTP VPN connection to an arbitrary PPTP VPN server, and sending a malicious GRE frame through the data plane of the AP. A successful exploit could allow the attacker to cause an internal process of the targeted AP to crash, which in turn would cause the AP to reload. The AP reload would cause a DoS condition for clients that are associated with the AP.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01374 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Aironet Access Point Softwareall versions—No fix listedCNA
  • Cisco Aironet Access Point Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:cisco:aironet_1810_firmware:*:*:*:*:*:*:*:*8.4 to before 8.5.151.0; 8.8 to before 8.8.125.0; 8.9 to before 8.9.111.0VulnerableCisco
cpe:2.3:h:cisco:aironet_1810:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:aironet_1830_firmware:*:*:*:*:*:*:*:*8.4 to before 8.5.151.0; 8.8 to before 8.8.125.0; 8.9 to before 8.9.111.0VulnerableCisco
cpe:2.3:h:cisco:aironet_1830:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:aironet_1850_firmware:*:*:*:*:*:*:*:*8.4 to before 8.5.151.0; 8.8 to before 8.8.125.0; 8.9 to before 8.9.111.0VulnerableCisco
cpe:2.3:h:cisco:aironet_1850:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:aironet_1810_firmware:*:*:*:*:*:*:*:* Versions 8.4 to before 8.5.151.0; 8.8 to before 8.8.125.0; 8.9 to before 8.9.111.0 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:aironet_1810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:aironet_1830_firmware:*:*:*:*:*:*:*:* Versions 8.4 to before 8.5.151.0; 8.8 to before 8.8.125.0; 8.9 to before 8.9.111.0 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:aironet_1830:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:aironet_1850_firmware:*:*:*:*:*:*:*:* Versions 8.4 to before 8.5.151.0; 8.8 to before 8.8.125.0; 8.9 to before 8.9.111.0 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:aironet_1850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cisco Aironet Access Point Software n/a

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-11374 Cisco Aironet Access Points Unauthorized Access VulnerabilityPriority MEDIUM 54
    • TI-2019-11378 Cisco Aironet Access Points Bridge Protocol Data Unit Port Disable Denial of Service VulnerabilityPriority LOW 29
    • TI-2019-11377 Cisco Aironet Access Points and Catalyst 9100 Access Points CAPWAP Denial of Service VulnerabilityPriority LOW 29
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15261
  2. 2026-10-03 Alias added: GHSA-3273-9gqr-v74w

References

Advisory 1

  • TI-2020-15977 An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. CVSS 3.1MEDIUM 6.5
  • TI-2020-15976 An issue was discovered in the kernel in NetBSD 7.1. CVSS 3.1MEDIUM 5.3
  • TI-2020-15068 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired… CVSS 3.1LOW 3.5
  • TI-2020-15067 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired… CVSS 3.1LOW 2.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences