Description
A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
Metrics
CVSS 3.1 5.3/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Secure Web Appliance | 11.7.0-406; 11.7.0-418; 11.7.1-049; 11.7.1-006; 11.7.1-020; 11.7.2-011; 11.8.0-414; 11.8.1-023; 11.8.3-018; 11.8.3-021; 12.0.1-268; 12.0.3-007; 12.5.2-007; 12.5.1-011; 12.5.4-005; 12.5.5-004; 14.5.0-498; 14.5.1-016; 14.0.3-014; 14.0.2-012 |
References
Timeline
- Published
- Aug 3, 2023
- Last modified
- Jun 17, 2026
- NVD status
- Modified