Read the docs
TI-2019-11378 Aliases CVE-2019-15265GHSA-xp9v-28f9-8837

Cisco Aironet Access Points Bridge Protocol Data Unit Port Disable Denial of Service Vulnerability

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability in the bridge protocol data unit (BPDU) forwarding functionality of Cisco Aironet Access Points (APs) could allow an unauthenticated, adjacent attacker to cause an AP port to go into an error disabled state. The vulnerability occurs because BPDUs received from specific wireless clients are forwarded incorrectly. An attacker could exploit this vulnerability on the wireless network by sending a steady stream of crafted BPDU frames. A successful exploit could allow the attacker to cause a limited denial of service (DoS) attack because an AP port could go offline.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Aironet Access Point Softwareall versions—No fix listedCNA
  • Cisco Aironet Access Point Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:cisco:aironet_1540_firmware:*:*:*:*:*:*:*:*before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0VulnerableCisco
cpe:2.3:h:cisco:aironet_1540:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:aironet_1560_firmware:*:*:*:*:*:*:*:*before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0VulnerableCisco
cpe:2.3:h:cisco:aironet_1560:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:aironet_1800_firmware:*:*:*:*:*:*:*:*before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0VulnerableCisco
cpe:2.3:h:cisco:aironet_1800:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:aironet_2800_firmware:*:*:*:*:*:*:*:*before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0VulnerableCisco
cpe:2.3:h:cisco:aironet_2800:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:aironet_3800_firmware:*:*:*:*:*:*:*:*before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0VulnerableCisco
cpe:2.3:h:cisco:aironet_3800:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:aironet_1540_firmware:*:*:*:*:*:*:*:* Versions before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:aironet_1540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:aironet_1560_firmware:*:*:*:*:*:*:*:* Versions before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:aironet_1560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:aironet_1800_firmware:*:*:*:*:*:*:*:* Versions before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:aironet_1800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:aironet_2800_firmware:*:*:*:*:*:*:*:* Versions before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:aironet_2800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:aironet_3800_firmware:*:*:*:*:*:*:*:* Versions before 8.5.151.0; 8.6 to before 8.8.120.0; 8.8.125.0 to before 8.9.100.0 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:aironet_3800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cisco Aironet Access Point Software n/a

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-11374 Cisco Aironet Access Points Unauthorized Access VulnerabilityPriority MEDIUM 54
    • TI-2019-11375 Cisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service VulnerabilityPriority MEDIUM 46
    • TI-2019-11377 Cisco Aironet Access Points and Catalyst 9100 Access Points CAPWAP Denial of Service VulnerabilityPriority LOW 29
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15265
  2. 2026-10-03 Alias added: GHSA-xp9v-28f9-8837

References

Advisory 1

  • TI-2019-11374 Cisco Aironet Access Points Unauthorized Access Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-11377 Cisco Aironet Access Points and Catalyst 9100 Access Points CAPWAP Denial of Service Vulnerability CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences