search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Cisco Aironet AP1100 fails to provide universal login error messages thereby disclosing validity of user account

Vulnerability Note VU#886796

Original Release Date: 2003-07-28 | Last Revised: 2003-07-29


A vulnerability in the Cisco Aironet 1100 Series Access Point may allow a remote attacker to discover valid accounts on the access point.


Cisco describes the Aironet 1100 Series Access Point as, "an affordable and upgradable 802.11b wireless LAN (WLAN) solution, setting the enterprise standard for high performance, secure, manageable, and reliable WLANs." A vulnerability in this access point may allow a remote attacker to discover valid accounts on the device using brute-force techniques. For further technical information, please see the following documents:


A remote attacker may be able to discover valid accounts on a vulnerable access point.


Apply a vendor-supplied patch.

Quoting from Enumerating Locally Defined Users in Cisco IOS:
The preferred workaround is to disable Telnet access and use SSH instead. Please note that not all IOS software supports SSH. Registered users may check if their image supports SSH by visiting this URL (registered customers only).This can be accomplished like this:

Router(config)# hostname myRouter
myRouter(config)# ip domain name <your-domain>
myRouter(config)# crypto key generate rsa
The name for the keys will be: myRouter.your-domain
Choose the size of the key modulus in the range of 360 to 2048 for your
 General Purpose Keys. Choosing a key modulus greater than 512 may take
 a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys ...[OK]
myRouter(config)# line vty 0 5
myRouter(config-line)# transport input ssh

Note: The first two lines are optional.If you already have defined a hostname that is not Router and have defined domain name then you do not have to type them again.

The free version of SSH software can be obtained from Alternatively, you can buy a commercial software from various commercial vendors.

An optional workarond is to use "aaa new-model". Before applying the workaround you may want to consult the following document Cisco IOS Security Configuration Guide, Release 12.2 -- Part 1: Authentication, Authorization, and Accounting (AAA) that is at

Router(config)# aaa new-model
Router(config)# username guest password 0 secretpassword
Router(config)# aaa authentication login telnet-group local
Router(config)# line vty 0 5
Router(config-line)# login authentication telnet-group

Vendor Information


Cisco Systems Inc. Affected

Updated:  July 28, 2003



Vendor Statement

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This vulnerability was discovered by Reda Zitouni of the Security Watch Team at VIGILANTe.

This document was written by Ian A Finlay.

Other Information

CVE IDs: CVE-2003-0512
Severity Metric: 4.80
Date Public: 2003-07-28
Date First Published: 2003-07-28
Date Last Updated: 2003-07-29 13:21 UTC
Document Revision: 16

Sponsored by CISA.