PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9220 Cisco CVE debrief

CVE-2016-9220 is a denial-of-service issue in 802.11 ingress packet processing on Cisco Mobility Express 2800 and 3800 Access Points. An unauthenticated attacker on an adjacent network can cause the connection table to fill with invalid connections, preventing the device from processing new incoming requests. Cisco identified affected release 8.2(130.0) and published fixed releases in several later trains.

Vendor
Cisco
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-26
Original CVE updated
2026-05-13
Advisory published
2017-01-26
Advisory updated
2026-05-13

Who should care

Organizations running Cisco Mobility Express on 2800 or 3800 access points, especially wireless administrators and network operations teams responsible for campus, branch, or guest Wi-Fi availability.

Technical summary

The flaw is described as a DoS condition in 802.11 ingress packet processing. NVD assigns CVSS v3.0 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L and CWE-399, indicating an adjacent, unauthenticated attack that impacts availability only. The vendor advisory notes that invalid connections can exhaust the connection table and block new requests.

Defensive priority

Medium. The issue does not disclose data or alter integrity, but it can disrupt wireless service on affected access points. Prioritize if the impacted APs are customer-facing or operationally critical.

Recommended defensive actions

  • Confirm whether Cisco Mobility Express APs are running release 8.2(130.0) or another affected version listed by Cisco.
  • Upgrade to a fixed release from Cisco's advisory, such as 8.2(131.10), 8.2(131.6), 8.2(141.0), 8.3(104.56), 8.4(1.88), or 8.4(1.91), according to your supported train.
  • Review wireless network monitoring and alerting for repeated connection-table exhaustion or abnormal request-processing failures.
  • Restrict adjacency to trusted wireless environments where feasible, since the attack requires adjacent network access.
  • Track Cisco security advisories and confirm appliance firmware compliance during maintenance windows.

Evidence notes

All claims are drawn from the supplied NVD record and Cisco advisory references. The vulnerability was published on 2017-01-26 and later modified in the source record on 2026-05-13. The CVSS vector, affected release, fixed releases, and CWE classification come from the provided source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9220 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9220

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9220 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9220

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.