CVE-2012-5992
Cisco Wireless LAN Controller Software CSRF via Admin Account Creation or XSS
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-5992.
AI-analyzed exploit summary The exploit demonstrates a chained attack against Cisco Wireless Lan Controller 7.2.110.0, combining CSRF to add an administrator account, persistent XSS via crafted input fields, and a DoS trigger via a malformed GET request. The PoC includes functional HTML/JavaScript code for CSRF and XSS, along with a documented DoS vector requiring authentication.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via screens/aaa/mgmtuser_create.html or (2) insert XSS sequences via the headline parameter to screens/base/web_auth_custom.html, aka Bug ID CSCud50283.
Exploits (1)
The exploit demonstrates a chained attack against Cisco Wireless Lan Controller 7.2.110.0, combining CSRF to add an administrator account, persistent XSS via crafted input fields, and a DoS trigger via a malformed GET request. The PoC includes functional HTML/JavaScript code for CSRF and XSS, along with a documented DoS vector requiring authentication.