PT-2021-3721 · Cisco · Cisco Email Security Appliance+3

Published 2021-06-16 · Updated 2021-06-23 · CVE-2021-1566

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) (affected versions not specified)

Description A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This issue is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this by sending a crafted TLS packet to an affected device, potentially allowing the attacker to spoof a trusted host, extract sensitive information, or alter certain API requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-296

Related Identifiers

BDU:2021-03961

CVE-2021-1566

Affected Products

Cisco Advanced Malware Protection (Amp) For Endpoints

Cisco Asyncos

Cisco Email Security Appliance

Cisco Web Security Appliance

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-1566 · Security Note
• https://bdu.fstec.ru/vul/2021-03961 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-cert-vali-n8L97RW · Vendor Advisory
• https://t.me/cvenotify/16471 · Telegram Post