CISCO-SA-9800CL-OPENSCEP-SB4XTXZP

Vulnerable Products:

At the time of publication, this vulnerability affected Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud, regardless of device configuration.

For information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.Products Confirmed Not Vulnerable:

Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.

Cisco has confirmed that this vulnerability does not affect Cisco IOS XE Software for Catalyst 9800 Series Wireless Hardware-based Controllers.Workarounds:

There is a workaround that addresses this vulnerability. An administrator can shut down the hostname_WLC_CA PKI server that has a hostname that matches the hostname of the wireless LAN controller (WLC). The following output shows the necessary steps to follow in an example where the WLC hostname is vewlc:

vewlc# conf t vewlc(config)# crypto pki server vewlc_WLC_CA vewlc(cs-server)# shutdown vewlc(cs-server)# exit vewlc# write memory

While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.Fixed Software:

Cisco considers any workarounds and mitigations to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed...