PT-2024-4846 · Cisco · Cisco Secure Email Gateway

Published 2024-07-17 · Updated 2024-10-05 · CVE-2024-20401

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Secure Email Gateway (affected versions not specified)

Description: A vulnerability in the content scanning and message filtering features could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this by sending an email with a crafted attachment through an affected device, potentially allowing them to replace any file on the underlying file system, add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition. Manual intervention is required to recover from the DoS condition.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-36

Related Identifiers

BDU:2024-05370

CVE-2024-20401

Affected Products

Cisco Secure Email Gateway

References · 9

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-bGG2UsjH · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20401 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05370 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20401 · Security Note
• https://t.me/pentestingnews/49235 · Telegram Post
• https://t.me/cvedetector/1104 · Telegram Post
• https://twitter.com/TheSecMaster1/status/1842545790880804881 · Twitter Post
• https://twitter.com/Komodosec/status/1827407294486999072 · Twitter Post
• https://t.me/cvenotify/86548 · Telegram Post