CVE-2019-1830: Cisco Wireless LAN Controller Locally Significant Certificate Denial of Service Vulnerability

Severity: medium (CVSS 4.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-18 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in Locally Significant Certificate (LSC) management for the Cisco Wireless LAN Controller (WLC) could allow an authenticated, remote attacker to cause the device to unexpectedly restart, which causes a denial of service (DoS) condition. The attacker would need to have valid administrator credentials. The vulnerability is due to incorrect input validation of the HTTP URL used to establish a connection to the LSC Certificate Authority (CA). An attacker could exploit this vulnerability by authenticating to the targeted device and configuring a LSC certificate. An exploit could allow the attacker to cause a DoS condition due to an unexpected restart of the device.

Affected products

Cisco Wireless LAN Controller (WLC): before 8.3.150.0; from 8.5.131.0 before 8.5.140.0; from 8.6.101.0 before 8.8.100.0 — fixed in 8.3.150.0, 8.5.140.0, 8.8.100.0

How to fix

Upgrade to a fixed version: Cisco Wireless LAN Controller (WLC) 8.3.150.0, 8.5.140.0, 8.8.100.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-1830 or the next vulnerability affects your stack