Third time’s NOT the charm for Cisco’s adaptive WIPS (aWIPS)

Cisco Wireless LAN Controllers Wireless Intrusion Prevention System Denial of Service Vulnerability

By Hemant Chaskar Can you beleive it? – yet another alert came out about a vulnerability in Cisco’s WIPS (adaptive Wireless Intrusion Prevention System or aWIPS as Cisco likes to call it): Cisco Warns of Vulnerabilities in Wireless LAN Controllers by Mike Lennon Managing Editor at Security Week Cisco Wireless LAN Controllers Wireless Intrusion Prevention System… Read More

Skyjacking attack – then Cisco, now Aruba?


Recall “Skyjacking” vulnerability discovered with Cisco LAPs couple of years ago? It allowed hacker to transfer control of enterprise Cisco LAPs from enterprise WLC to hacker controlled WLC in the Internet with over-the-air attack. Once control is transferred, the hacker could change configuration on those LAPs in any way by adding, deleting and modifying SSIDs. The hacker could… Read More

Skyjacking: What went wrong?

Security is hard to get right and shortcuts — be it coding shortcuts or design shortcuts – come back and haunt the product designers when the rubber hits the road. The recently discovered “skyjacking” vulnerability of the Cisco LAPs seems to be a classic example.  The “Over The Air Provisioning” (OTAP) feature allows an out-of-the-box… Read More

Cisco AP Skyjacking

This latest vulnerability on Cisco WLAN (AP Skyjacking) points out the importance for customers to deploy overlay WIPS to have a zero day response capabilities in place. Making changes to your WLAN controller, APs, and firewalls takes time and new vulnerabilities like this will continue to surface.  A dangerous exploit that can be carried out using this vulnerability… Read More

Is skyjacking a mere DoS threat against Cisco WLAN?

Skyjacking vulnerability which allows Cisco LAP to be diverted to connect to rogue controller by manipulating OTAP could be more dangerous than what has been clarified by Cisco in its advisory. The advisory says that “An exploit could prevent the device from functioning properly, resulting in a DoS condition. There is no risk of data loss… Read More