CVE-2019-15276: Cisco Wireless LAN Controller web interface URL parsing DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityThe flaw causes full availability loss on a network-critical controller, a public exploit reference exists, and EPSS is high despite the medium CVSS score and no KEV listing.

What it is

Cisco Wireless LAN Controller Software fails to properly validate specially crafted URLs in its web interface HTTP parsing engine. A low-privileged authenticated remote attacker, or an unauthenticated attacker who convinces a logged-in user to click a crafted URL, can trigger an unexpected device restart. The result is a denial of service on the controller, which can disrupt managed wireless access.

Impact

An attacker can force an unexpected restart of the affected controller, causing a denial of service and loss of wireless management or connectivity for dependent access points and clients. No confidentiality or integrity impact is described; the effect is availability only.

Attack surface

Reachable over the network through the controller web interface. Exploitation requires either low-privileged authentication or, for an unauthenticated attacker, user interaction in the form of a victim clicking a crafted URL.

Exploitation

Not listed in CISA KEV, but a public exploit reference exists (Packet Storm advisory tagged Exploit) and EPSS is high at roughly 0.46 probability (98.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the Cisco security advisory cisco-sa-20191106-wlc-dos fix for affected Wireless LAN Controller Software versions.
• Restrict web interface access to trusted management networks and disable it where not required.
• Enforce least privilege so few accounts hold even low-privileged web access.
• Filter or block malformed and suspicious URL patterns at the management boundary.
• Monitor controller restarts and correlate them with web interface access logs.

Detection

• Alert on unexpected controller restarts or reboots and correlate with web interface sessions.
• Review web interface access logs for malformed or unusually crafted URL requests.
• Monitor for low-privileged accounts submitting anomalous HTTP requests to the controller.
• Track authentication events followed closely by device restart or availability loss.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.