Cisco Security Advisory
-
A configuration option for the Splash Page feature (also known as Captive Portal) in Cisco Meraki MR Series devices may allow an administrator to configure an 802.11 WLAN in which traffic policies are not applied to clients that are connecting to the network.
The insecure configuration is determined when an administrator configures a WLAN with Splash Page access control and Captive Portal strength is set to Allow non-HTTP traffic prior to sign-on.
While this setup is intended to provide wireless clients with connectivity before they interact with the Splash Page, traffic policies are applied only after the sign on is completed. A malicious user could take advantage of this insecure configuration to circumvent network policies such as firewall rules, content filtering, and traffic shaping that is configured to restrict traffic within the impacted WLAN.
Cisco Meraki does not consider this to be a vulnerability in Cisco Meraki MR Software or in the Splash Page feature. It is considered a configuration issue.
For more robust network security, Cisco Meraki recommends following the guidance in the Recommendations section of this advisory to make any appropriate configuration changes.
Note: The option is disabled by default on WLANs that were created through the Cisco Meraki Cloud Management Interface (also known as Dashboard) after December 4, 2020.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-config-Ab3Da
-
Vulnerable Products
At the time of publication, this issue affected Cisco Meraki MR Series devices if they were configured with a WLAN that uses a Splash Page for access control, and Captive portal strength is set to Allow non-HTTP traffic prior to sign-on.
Determine Whether a Device is Affected
To determine whether a device is affected by the issue that is described in this advisory, complete the following steps:
Step 1: Determine whether a Splash Page is configured
- Log in to the Dashboard.
- Choose Wireless > Configure > Access control in the Combined view.
- Choose the appropriate WLAN from the SSID drop-down menu.
- Locate and expand the Splash Page section.
If Splash Page type is set to any value other than None (direct access), then the WLAN was configured to use a Splash Page for access control. Continue to Step 2.
If Splash Page type is set to None (direct access) or if the Advanced splash settings section cannot be expanded, then the WLAN is not configured to use a Splash Page for access control and is not susceptible to the issue that is described in this advisory.
Step 2: Determine the Captive Portal strength settings
- From the Splash Page section, click Advanced splash settings to expand the Configuration section.
- Locate the Captive portal strength drop-down menu.
If Captive portal strength is set to Allow non-HTTP traffic prior to sign-on, then the WLAN is configured with the insecure configuration option that is described in this advisory.
If Captive portal strength is set to Block all access until sign-on is complete, then the WLAN is not configured with the insecure configuration option and it is not susceptible to the issue that is described in this advisory.
On a Cisco Meraki MR device, a separate Splash Page can be configured for each WLAN in use. Each Splash Page has specific Captive Portal strength settings. Cisco Meraki recommends reviewing the configuration of each WLAN that is enabled on the device, as indicated in the Recommendations section of this advisory.
-
The target audience of this informational advisory is those customers who have deployed WLAN networks using a Splash Page for access control.
The Cisco Meraki Splash Page is a web-based access control feature that requires users to view and interact with an HTML page before gaining full network access. The scope of network access that a client has before interacting with the Splash Page is restricted through the Captive portal strength settings. When Captive portal strength is set to Allow non-HTTP traffic prior to sign-on, network connectivity is provided to wireless clients before they interact with the Splash Page, with the exception of traffic that is destined for TCP Port 80.
On Cisco Meraki MR Series devices, Captive portal strength settings take precedence over configured traffic shaping, content filtering, and firewall rules when the Splash Page is configured. The user-defined WLAN traffic policies will be applied after the sign on is completed.
For more information about the Cisco Meraki Splash Page, see Splash Page.
-
Cisco Meraki recommends reviewing the configuration of each WLAN in use. In a WLAN deployment where access is controlled through the Splash Page, Cisco Meraki recommends setting the Captive portal strength to Block all access until sign-on is complete.
To adopt a more secure setup complete the following steps:
- Log in to the Dashboard.
- Choose Wireless > Configure > Access control in the Combined view.
- Choose the appropriate WLAN from the SSID drop-down menu.
- Locate the Splash Page section.
- Click Advanced splash settings to expand the Configuration section.
- From the Captive portal strength drop-down menu, choose Block all access until sign-on is complete if is it not already chosen.
If the Advanced splash settings section cannot be expanded, then the WLAN is not configured to use a Splash Page for access control and is not susceptible to the issue that is described in this advisory.
If Captive portal strength is set to Block all access until sign-on is complete, then the WLAN is not susceptible to the issue that is described in this advisory.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessVersion Description Section Status Date 1.0 Initial public release. — Final 2022-SEP-07
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.