PT-2020-4264 · Cisco · Cisco Asyncos+1

Published 2020-09-02 · Updated 2021-10-19 · CVE-2020-3546

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Email Security Appliance (ESA) (affected versions not specified)

Description: A vulnerability in the web-based management interface of Cisco AsyncOS software could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The issue is due to insufficient validation of requests sent to the web-based management interface. An attacker could exploit this by sending a crafted request to the interface, potentially obtaining IP addresses configured on the internal interfaces of the affected device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider implementing the provided workaround that addresses this issue. Restrict access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface until the issue is resolved or the workaround is applied.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04728

CVE-2020-3546

Affected Products

Cisco Asyncos

Cisco Email Security Appliance

References · 4

• https://osv.dev/vulnerability/CVE-2020-3546 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04728 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-info-disclosure-vMJMMgJ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3546 · Security Note