CVE-2021-1566
published 2021-06-16CVE-2021-1566: A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco…
PriorityP346high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.67%
47.9th percentile
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | asyncos | < 12.5.3-035 | 12.5.3-035 |
| cisco | asyncos | < 11.8.3-021 | 11.8.3-021 |
| cisco | asyncos | >= 12.0.0 < 12.0.3-005 | 12.0.3-005 |
| cisco | asyncos | >= 12.5.0 < 12.5.1-043 | 12.5.1-043 |
| cisco | asyncos | >= 13.0 < 13.0.0-030 | 13.0.0-030 |
| cisco | asyncos | >= 13.5 < 13.5.3-010 | 13.5.3-010 |
| cisco | cisco_web_security_appliance | — | — |
| cisco | email_security_appliance_and_cisco_web_security_appliance | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_cisco7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9pg8-7479-p4jw: A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and
ghsa_unreviewed·2022-05-24
CVE-2021-1566 [HIGH] CWE-295 GHSA-9pg8-7479-p4jw: A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.
Cisco
Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
vendor_cisco·2021-06-16·CVSS 7.4
CVE-2021-1566 [HIGH] CWE-296 Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers.
This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.
Cisco has released soft
Cisco
Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1566 Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
CVE-2021-1566: Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests. Cisco has
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-16
Published