HIGH✓ PATCH🇬🇧 English

CVE-2021-1566

CVSS 7.4v3.1pub. 2021-06-16upd. 2024-11-21

A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Cisco Asyncos

    OS
    Cisco
    12.0.0 – 12.0.3-005 (bez)< 12.5.3-03513.0 – 13.0.0-030 (bez)13.5 – 13.5.3-010 (bez)12.5.0 – 12.5.1-043 (bez)< 11.8.3-021

  • Cisco Email Security Appliance

    APP
    Cisco
    wszystkie wersje

  • Cisco Web Security Appliance

    APP
    Cisco
    wszystkie wersje
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
CWE
Referencje

Powiązane podatności

CVE-2025-20393CRITICAL10.0⚠ KEVPL ✓ten sam produkt

RCE z uprawnieniami root w Cisco Secure Email Gateway i Secure Email and Web Manager

CVE-2023-20032CRITICAL9.8ten sam produkt

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerabilit...

CVE-2022-20798CRITICAL9.8ten sam produkt

A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly k...

CVE-2024-20435HIGH8.8ten sam produkt

A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attac...

CVE-2022-20960HIGH7.5ten sam produkt

A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthentica...