Description
A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Management Security Appliance (SMA) could allow an unauthenticated, remote attacker to impersonate the update server. More Information: CSCul88715, CSCul94617, CSCul94627. Known Affected Releases: 7.5.2-201 7.6.3-025 8.0.1-023 8.5.0-000 8.5.0-ER1-198 7.5.2-HP2-303 7.7.0-608 7.7.5-835 8.5.1-021 8.8.0-000 7.9.1-102 8.0.0-404 8.1.1-013 8.2.0-222. Known Fixed Releases: 8.0.2-069 8.0.2-074 8.5.7-042 9.1.0-032 8.5.2-027 9.6.1-019.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-asyncos
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/94791
Scores
CVSS v3
5.9
EPSS
0.0112
EPSS Percentile
62.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-310
Status
published
Products (17)
cisco/content_security_management_appliance
9.1.0
cisco/content_security_management_appliance
9.1.0-004
cisco/content_security_management_appliance
9.1.0-031
cisco/content_security_management_appliance
9.1.0-033
cisco/content_security_management_appliance
9.1.0-103
cisco/content_security_management_appliance
9.6.0
cisco/email_security_appliance
7.5.2-201
cisco/email_security_appliance
7.5.2-hp2-303
cisco/email_security_appliance
7.6.3-025
cisco/email_security_appliance
8.0.1-023
... and 7 more
Published
Dec 14, 2016
Tracked Since
Feb 18, 2026