Cisco Access Point Software Uncontrolled Resource Consumption Vulnerability
Priority LOW 21CWE-400Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device. This vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker could exploit this vulnerability by sending a series of specific wireless packets to an affected device. A successful exploit could allow the attacker to consume resources on an affected device. A sustained attack could lead to the disruption of the Control and Provisioning of Wireless Access Points (CAPWAP) tunnel and intermittent loss of wireless client traffic.
Why it matters now
EPSS 0.00264 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Aironet Access Point Software | 8.3.135.0; 8.3.140.0; 8.8.111.0; 8.5.151.0; 8.3.104.46; 8.10.121.0; 8.4.1.218; 8.3.122.0; 8.8.100.0; 8.3.131.0; 8.5.140.0; 8.3.132.0; 8.5.100.0; 8.5.103.0; 8.3.133.0; 8.3.150.0; 8.5.101.0; 8.5.105.0; 8.10.122.0; 8.8.130.0; 8.10.112.0; 8.3.143.0; 8.8.120.0; 8.9.111.0; 8.5.102.0; 8.5.161.0; 8.3.121.0; 8.9.100.0; 8.10.111.0; 8.2.170.0; 8.2.163.0; 8.10.130.0; 8.10.105.0; 8.6.101.0; 8.3.104.64; 8.3.15.117; 8.5.110.0; 8.2.161.0; 8.4.1.199; 8.4.100.0; 8.5.131.0; 8.7.1.16; 8.4.1.175; 8.3.141.0; 8.3.108.0; 8.2.111.0; 8.5.135.0; 8.2.160.0; 8.5.120.0; 8.6.1.84; 8.7.106.0; 8.6.1.70; 8.3.90.36; 8.10.113.0; 8.7.102.0; 8.2.130.0; 8.3.130.0; 8.2.110.0; 8.3.15.142; 8.3.111.0; 8.4.1.142; 8.6.1.71; 8.3.104.14; 8.8.125.0; 8.3.112.0; 8.2.151.0; 8.3.90.53; 8.3.102.0; 8.2.166.0; 8.2.164.0; 8.5.160.0; 8.3.15.165; 8.4.2.75; 8.3.90.58; 8.3.90.25; 8.2.141.0; 8.3.90.11; 8.3.15.169; 8.3.15.158; 8.3.15.25; 8.3.104.37; 8.4.1.91; 8.2.100.0; 8.2.121.0; 8.3.15.120; 8.3.15.118; 8.4.1.92; 8.3.200.200; 8.10.141.0; 8.10.142.0; 8.5.171.0; 8.10.150.0; 8.10.151.0; 8.5.164.0; 8.10.161.0; 8.10.162.0; 8.5.182.0; 8.10.171.0; 8.10.170.0; 8.10.180.0; 8.10.181.0; 8.10.182.0; 8.10.183.0; 8.10.185.0; 8.5.182.11 ME | — | No fix listed | CNA |
| Cisco | Cisco Aironet Access Point Software (IOS XE Controller) | 17.1.1t; 16.10.1s; 16.10.1; 17.3.1; 16.11.1b; 17.1.2; 17.1.1; 16.12.4; 17.2.2; 16.12.3; 16.11.1a; 16.12.2t; 16.10.1e; 16.11.1; 16.11.1c; 17.1.1s; 16.12.3s; 16.12.1s; 16.12.1t; 16.12.2s; 17.2.1; 17.2.1a; 16.12.1; 17.1.3; 17.3.2a; 16.12.5; 17.3.2; 17.4.1; 16.12.4a; 17.3.3; 17.2.3; 17.5.1; 17.4.2; 17.3.5; 17.3.4; 16.12.6; 17.6.1; 17.7.1; 17.6.2; 16.12.6a; 17.3.4c; 16.12.7; 17.3.5a; 17.6.3; 17.8.1; 17.9.1; 16.12.8; 17.6.4; 17.3.5b; 17.3.6; 17.10.1; 17.9.2; 17.6.5; 17.3.7; 17.9.3; 17.11.1; 17.6.6; 17.3.8 | — | No fix listed | CNA |
| Cisco | Cisco Business Wireless Access Point Software | 10.3.1.0; 10.0.1.0; 10.2.1.0; 10.1.1.0; 10.3.1.1; 10.4.1.0; 10.6.1.0; 10.1.2.0; 10.0.2.0; 10.7.1.0; 10.2.2.0; 0.0.0.0; 10.3.2.0; 10.4.2.0; 10.8.1.0; 10.5.2.0; 10.9.1.0 | — | No fix listed | CNA |
- Cisco Aironet Access Point Software VendorCisco Affected 8.3.135.0; 8.3.140.0; 8.8.111.0; 8.5.151.0; 8.3.104.46; 8.10.121.0; 8.4.1.218; 8.3.122.0; 8.8.100.0; 8.3.131.0; 8.5.140.0; 8.3.132.0; 8.5.100.0; 8.5.103.0; 8.3.133.0; 8.3.150.0; 8.5.101.0; 8.5.105.0; 8.10.122.0; 8.8.130.0; 8.10.112.0; 8.3.143.0; 8.8.120.0; 8.9.111.0; 8.5.102.0; 8.5.161.0; 8.3.121.0; 8.9.100.0; 8.10.111.0; 8.2.170.0; 8.2.163.0; 8.10.130.0; 8.10.105.0; 8.6.101.0; 8.3.104.64; 8.3.15.117; 8.5.110.0; 8.2.161.0; 8.4.1.199; 8.4.100.0; 8.5.131.0; 8.7.1.16; 8.4.1.175; 8.3.141.0; 8.3.108.0; 8.2.111.0; 8.5.135.0; 8.2.160.0; 8.5.120.0; 8.6.1.84; 8.7.106.0; 8.6.1.70; 8.3.90.36; 8.10.113.0; 8.7.102.0; 8.2.130.0; 8.3.130.0; 8.2.110.0; 8.3.15.142; 8.3.111.0; 8.4.1.142; 8.6.1.71; 8.3.104.14; 8.8.125.0; 8.3.112.0; 8.2.151.0; 8.3.90.53; 8.3.102.0; 8.2.166.0; 8.2.164.0; 8.5.160.0; 8.3.15.165; 8.4.2.75; 8.3.90.58; 8.3.90.25; 8.2.141.0; 8.3.90.11; 8.3.15.169; 8.3.15.158; 8.3.15.25; 8.3.104.37; 8.4.1.91; 8.2.100.0; 8.2.121.0; 8.3.15.120; 8.3.15.118; 8.4.1.92; 8.3.200.200; 8.10.141.0; 8.10.142.0; 8.5.171.0; 8.10.150.0; 8.10.151.0; 8.5.164.0; 8.10.161.0; 8.10.162.0; 8.5.182.0; 8.10.171.0; 8.10.170.0; 8.10.180.0; 8.10.181.0; 8.10.182.0; 8.10.183.0; 8.10.185.0; 8.5.182.11 ME Fixed in — No fix listed CNA
- Cisco Aironet Access Point Software (IOS XE Controller) VendorCisco Affected 17.1.1t; 16.10.1s; 16.10.1; 17.3.1; 16.11.1b; 17.1.2; 17.1.1; 16.12.4; 17.2.2; 16.12.3; 16.11.1a; 16.12.2t; 16.10.1e; 16.11.1; 16.11.1c; 17.1.1s; 16.12.3s; 16.12.1s; 16.12.1t; 16.12.2s; 17.2.1; 17.2.1a; 16.12.1; 17.1.3; 17.3.2a; 16.12.5; 17.3.2; 17.4.1; 16.12.4a; 17.3.3; 17.2.3; 17.5.1; 17.4.2; 17.3.5; 17.3.4; 16.12.6; 17.6.1; 17.7.1; 17.6.2; 16.12.6a; 17.3.4c; 16.12.7; 17.3.5a; 17.6.3; 17.8.1; 17.9.1; 16.12.8; 17.6.4; 17.3.5b; 17.3.6; 17.10.1; 17.9.2; 17.6.5; 17.3.7; 17.9.3; 17.11.1; 17.6.6; 17.3.8 Fixed in — No fix listed CNA
- Cisco Business Wireless Access Point Software VendorCisco Affected 10.3.1.0; 10.0.1.0; 10.2.1.0; 10.1.1.0; 10.3.1.1; 10.4.1.0; 10.6.1.0; 10.1.2.0; 10.0.2.0; 10.7.1.0; 10.2.2.0; 0.0.0.0; 10.3.2.0; 10.4.2.0; 10.8.1.0; 10.5.2.0; 10.9.1.0 Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:* | before 8.10.190.0 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:catalyst_9800_embedded_wireless_controller_firmware:*:*:*:*:*:*:*:* | before 17.3.8; 17.4.0 to before 17.6.6; 17.8.0 to before 17.9.4 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:catalyst_9800_embedded_wireless_controller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:business_150ax_firmware:*:*:*:*:*:*:*:* | before 10.6.2.0 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:business_150ax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:business_151axm_firmware:*:*:*:*:*:*:*:* | before 10.6.2.0 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:business_151axm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:* Versions before 8.10.190.0 Vulnerable ·Cisco
- cpe:2.3:o:cisco:catalyst_9800_embedded_wireless_controller_firmware:*:*:*:*:*:*:*:* Versions before 17.3.8; 17.4.0 to before 17.6.6; 17.8.0 to before 17.9.4 Vulnerable ·Cisco
- cpe:2.3:h:cisco:catalyst_9800_embedded_wireless_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:business_150ax_firmware:*:*:*:*:*:*:*:* Versions before 10.6.2.0 Vulnerable ·Cisco
- cpe:2.3:h:cisco:business_150ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:business_151axm_firmware:*:*:*:*:*:*:*:* Versions before 10.6.2.0 Vulnerable ·Cisco
- cpe:2.3:h:cisco:business_151axm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-20268
- 2026-10-03 Alias added: GHSA-p572-r8g2-hv9h
References
Advisory 1
More Cisco Business 150ax Firmware vulnerabilities
- TI-2023-06819 Cisco Access Point Software Association Request Denial of Service Vulnerability CVSS 3.1HIGH 7.4
Sources
- CVE-2023-20268 · CVE Program
- CVE-2023-20268 · NVD
- FIRST EPSS
- GHSA-p572-r8g2-hv9h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences