CVE-2018-0250

lowpriority · track · 16EPSS 0.005 · 39 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.45% (39th) EPSS

CVSS 2.7 · low

Is it mine?

5 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisco_csaf · nvd

EPSS · scored 2026-10-26

A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list (ACL). The vulnerability is due to the AP ignoring the ACL download from the client during authentication. An attacker could exploit this vulnerability by connecting to the targeted device with a vulnerable configuration. A successful exploit could allow the attacker to bypass a configured client FlexConnect ACL. This vulnerability affects the following Cisco products if they are running a vulnerable release of Central Web Authentication with FlexConnect Access Points Software: Aironet 1560 Series Access Points, Aironet 1810 Series OfficeExtend Access Points, Aironet 1810w Series Access Points, Aironet 1815 Series Access Points, Aironet 1830 Series Access Points, Aironet 1850 Series Access Points, Aironet 2800 Series Access Points, Aironet 3800 Series Access Points. Note: Central Web Authentication with FlexConnect Access Points was an unsupported configuration until 8.5.100.0. Cisco Bug IDs: CSCve17756.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco Aironet Access Point Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco Aironet Access Point Softwarecisco_csaf
If the client has to authenticate for a second time then the ACL is properly applied and there is no security vulnerability; therefore, a mitigation for this vulnerability could be to force a client to re-authenticate.

cvss

Technical severity, 0–10. One row per scoring source.

4.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–4.1

v2.02.7lowAV:A/AC:L/Au:S/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 5.1 · impact 2.9

v3.04.1mediumCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 2.3 · impact 1.4

v3.03.8lowCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.04.1mediumCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:Nsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-693USprimary

affected products (5)

Products and version ranges known to be affected.

Cisco Cisco Aironet Access Point Softwareall versionscisco_csafUS
n/a Cisco Aironet Access Points≤ Cisco Aironet Access Pointsenisa_euvdEU
cisco aironet access point software= 8.2(160.0)nvdUScpe:2.3:o:cisco:aironet_access_point_software:*:*:*:*:*:*:*:*
cisco aironet access point software= 8.4(100.0)nvdUScpe:2.3:o:cisco:aironet_access_point_software:*:*:*:*:*:*:*:*
cisco aironet access point software= 8.7(1.3)nvdUScpe:2.3:o:cisco:aironet_access_point_software:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

cisco-sa-20180502-ap-aclCisco Aironet Access Points Central Web Authentication FlexConnect Client ACL Bypass Vulnerability2018-05-02csaf · cisco_csafUS
A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list (ACL). The vulnerability is due to the AP ignoring the ACL download from the client during authentication. An attacker could exploit this vulnerability by connecting to the targeted device with a vulnerable configuration. A successful exploit could allow the attacker to bypass a configured client FlexConnect ACL. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-ap-acl ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-ap-acl"]

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisco_csaf nvd NVD CVE.org MITRE

published 2018-05-02modified 2026-06-17

related (1,063)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-58704US	—OT critical	0.63% (50th)	KEV	2026-09-15
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional…
CVE-2026-32202US	—OT critical	70.9% (99th)	KEV	2026-04-14
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-21513US	—OT critical	15.9% (97th)	KEV	2026-02-10
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-21510US	—OT critical	61.2% (99th)	KEV	2026-02-10
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2025-40536US	critical9.8OT critical	73.6% (99th)	KEV	2026-01-28
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain…

+1058 more

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan