critical-flaw-in-cisco-secure-email-and-web-manager-lets-attackers-bypass-authentication

Share news article

Share on facebook
Share on twitter
Share on linkedin
Share on email

Critical Flaw in Cisco Secure Email and Web Manager Lets Attackers Bypass Authentication

Cisco on Wednesday rolled out fixes to address a critical security flaw affecting Email Security Appliance (ESA) and Secure Email and Web Manager that could be exploited by an unauthenticated, remote attacker to sidestep authentication.

Assigned the CVE identifier CVE-2022-20798, the bypass vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring system and stems from improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication.

“An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device,” Cisco noted in an advisory. “A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.”

The flaw, which it said was identified during the resolution of a technical assistance center (TAC) case, impacts ESA and Secure Email and Web Manager running vulnerable AsyncOS software versions 11 and earlier, 12, 12.x, 13, 13.x, 14, and 14.x and when the following two conditions are met –

  • The devices are configured to use external authentication, and
  • The devices use LDAP as authentication protocol

Separately, Cisco also notified customers of another critical flaw affecting its Small Business RV110W, RV130, RV130W, and RV215W routers that could allow an unauthenticated, remote adversary to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition.

The bug, tracked as CVE-2022-20825 (CVSS score: 9.8), relates to a case of insufficient user input validation of incoming HTTP packets. However, Cisco said it neither plans to release software updates nor workarounds to resolve the flaw because the products have reached end-of-life.


Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.

Related News

Vulnerability Summary for the Week of November 21, 2022

airbnb — optica A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially…
TikTok Invisible Body Challenge Trend Abused to Drop Malware

TikTok Invisible Body Challenge Trend Abused to Drop Malware

The newest trend on TikTok, the Invisible Body Challenge, is being abused by cybercriminals to spread WASP info-stealing malware. This…
Acer Laptop Vulnerability Allows Malware Infection During Secure Boot

Acer Laptop Vulnerability Allows Malware Infection During Secure Boot

Cybersecurity firm ESET’s researchers have identified a vulnerability affecting Acer laptops. The bug isn’t new, as ESET already discovered it…