PT-2017-17232 · Cisco · Cisco Email Security Appliance+1

Published 2017-06-13 · Updated 2017-11-27 · CVE-2017-6671

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance (ESA) versions 9.7.1-066 through 10.0.1-087

Description A vulnerability in the email message scanning of Cisco AsyncOS Software could allow an unauthenticated, remote attacker to bypass configured filters on the device. This issue is demonstrated by the Attachment Filter.

Recommendations For versions 9.7.1-066 through 10.0.1-087, update to version 9.8.1-015 or 10.0.2-020 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6671

Affected Products

Cisco Asyncos

Cisco Email Security Appliance

References · 5

• https://osv.dev/vulnerability/CVE-2017-6671 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6671 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-esa1 · Vendor Advisory
• http://securitytracker.com/id/1038635 · Note
• http://securityfocus.com/bid/98969 · Note