PT-2021-5120 · Cisco · Cisco Asyncos

Published 2021-10-06 · Updated 2021-10-14 · CVE-2021-1534

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS for Cisco Email Security Appliance (affected versions not specified)

Description The issue exists due to insufficient input validation and improper processing of URLs in the antispam protection mechanisms. An unauthenticated, remote attacker could exploit this by crafting a URL in a particular way, allowing them to bypass the URL reputation filters on an affected device. This could enable malicious URLs to pass through the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-05913

CVE-2021-1534

Affected Products

Cisco Asyncos

References · 6

• https://osv.dev/vulnerability/CVE-2021-1534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1534 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-sGcfsDrp · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05913 · Security Note
• https://t.me/cvenotify/22017 · Telegram Post
• https://t.me/cibsecurity/30122 · Telegram Post