CVE-2019-12706

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the configured user filters on an affected device. The vulnerability exists because the affected software insufficiently validates certain incoming SPF messages. An attacker could exploit this vulnerability by sending a custom SPF packet to an affected device. A successful exploit could allow the attacker to bypass the configured header filters, which could allow malicious content to pass through the device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Cisco	Cisco Email Security Appliance (ESA)	>= unspecified, < n/a

References

Timeline

Published: Oct 2, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-127076.1A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker CVE-2019-127086.5A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, CVE-2019-127096.7A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation CVE-2019-12717.8An elevation of privilege exists in hdAudio.sys which may lead to an out of band write, aka 'Windows Media Elevation of Privilege Vulnerabil CVE-2019-127104.9A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Manageme CVE-2019-127116.5A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Manageme CVE-2019-127126.1A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to condu CVE-2019-127136.1A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to condu CVE-2019-127146.5A vulnerability in the web-based management interface of Cisco IC3000 Industrial Compute Gateway could allow an authenticated, remote attack CVE-2019-127156.1A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Manageme CVE-2019-127166.1A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Manageme CVE-2019-127177.8A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco NX-OS Software could allow an authenticated, local at