EUVD-2026-15433
GHSA-m53c-9wh4-q9hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed CAPWAP packet
-
DeliverySend to affected CW9800 controller
-
ExploitTrigger improper packet handling
-
ExecutionDevice memory corruption
-
ImpactController reload and DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Missing parameter handling
|
| Exploitation Conditions | Remote unauthenticated attacker sending malformed CAPWAP packets to Cisco IOS XE Wireless Controller Software on Catalyst CW9800 Family devices with CAPWAP enabled (default configuration). No victim interaction required. |
| Impact | The CVSS v3.1 score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H indicates high real-world risk due to network-based attack vector requiring low complexity and no authentication or user interaction, with changed scope meaning the impact extends beyond the vulnerable component to managed access points. The high availability impact (A:H) is particularly concerning for wireless infrastructure where controller failure disrupts all connected access points and wireless clients. While no EPSS score, KEV listing, or public POC is mentioned in the available data, the vulnerability is publicly disclosed via Cisco's security advisory (cisco-sa-wlc-dos-hnX5KGOm) and cataloged in VulDB (353176) and ENISA EUVD (EUVD-2026-15433), increasing attacker awareness. The unauthenticated remote attack vector and denial of service impact make this a priority for organizations running affected Cisco wireless controllers, especially in critical infrastructure or high-availability environments. The SSVC framework would likely categorize this as requiring scheduled attention given the DoS-only impact without data compromise, but organizations with wireless-dependent operations should treat it as urgent. |
| Exploit ScenarioDerived | An attacker on the internet or untrusted network segment crafts a malformed CAPWAP packet with missing or improperly formatted fields and sends it directly to the wireless controller's management interface on UDP port 5246 or 5247. Because CAPWAP packets are accepted without authentication and the vulnerability has low attack complexity (AC:L), the attacker requires no special access or credentials. Upon processing the malformed packet, the wireless controller crashes and initiates an automatic reload, causing all connected access points to lose connectivity and resulting in a complete wireless network outage lasting several minutes until the controller reboots and re-establishes communication with access points. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
This is a denial of service vulnerability in Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family caused by improper handling of malformed CAPWAP (Control and Provisioning of Wireless Access Points) packets. The vulnerability affects multiple versions of Cisco IOS XE Software in the 17.14.x through 17.18.x release trains. An unauthenticated remote attacker can exploit this to cause the wireless controller to reload unexpectedly, resulting in complete network disruption with a high severity CVSS score of 8.6.
RemediationAI
Cisco recommends upgrading affected IOS XE Software installations to a fixed release as specified in the security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-dos-hnX5KGOm. Organizations should consult the Cisco Security Advisory for specific fixed versions corresponding to their current release train, as Cisco typically provides fixes in subsequent maintenance releases or suggested migration paths to newer trains. As an interim mitigation until patching is complete, network administrators should implement access control lists (ACLs) to restrict CAPWAP traffic (UDP ports 5246 and 5247) to only authorized access points using known IP addresses or subnets, preventing untrusted sources from sending malformed packets to the wireless controller. Additional hardening measures include deploying the wireless controllers behind firewalls with strict ingress filtering and enabling device monitoring to detect unexpected reload events that may indicate exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the CAPWAP protocol implementation, which is used for communication between wireless controllers and access points in enterprise wireless networks. According to the CPE data (cpe:2.3:a:cisco:cisco_ios_xe_software), this affects Cisco IOS XE Software specifically when deployed as wireless controller software on Catalyst CW9800 series devices. The root cause is classified as CWE-230 (Improper Handling of Missing Values), indicating the software fails to properly validate or handle missing or malformed fields in CAPWAP packets before processing them. CAPWAP operates over UDP port 5246/5247 and encapsulates wireless management and data frames, making it a critical protocol for wireless network infrastructure. The improper input validation allows specially crafted packets to trigger unexpected behavior leading to device reload.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed CAPWAP packet. An attacker could exploit this vulnerability by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition.
Executive ViewAI
An unauthenticated remote attacker can crash Cisco Catalyst CW9800 wireless controllers, causing complete network outages affecting all connected wireless users. Organizations using this equipment face significant operational risk until patches become available, potentially impacting business continuity and user productivity.
Implement network access controls to restrict CAPWAP packet sources; deploy packet filtering at network perimeter to block malformed CAPWAP traffic; enable enhanced monitoring and alerting for controller reload events; consider isolating affected controllers to lower-risk network segments; engage Cisco support for interim guidance on traffic filtering rules; establish rapid failover procedures to secondary controllers if available; monitor Cisco security advisories daily for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB