CVE-2025-20183
published 2025-02-05CVE-2025-20183: A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.42%
34.2th percentile
A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint.
The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.
Affected
103 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_cisco5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Secure Web Appliance Range Request Bypass Vulnerability
vendor_cisco·2025-02-05·CVSS 5.8
CVE-2025-20183 [MEDIUM] CWE-20 Cisco Secure Web Appliance Range Request Bypass Vulnerability
Cisco Secure Web Appliance Range Request Bypass Vulnerability
A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint.
The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.
Cisco has released software updates that address this vulnerability. The
Cisco
Cisco Secure Web Appliance Range Request Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20183 Cisco Secure Web Appliance Range Request Bypass Vulnerability
CVE-2025-20183: Cisco Secure Web Appliance Range Request Bypass Vulnerability
A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint. The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance. Cisco has released software updates that address this vulne
GHSA
GHSA-6fqv-9m7r-mcwr: A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Applian
ghsa_unreviewed·2025-02-05
CVE-2025-20183 [MEDIUM] CWE-20 GHSA-6fqv-9m7r-mcwr: A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Applian
A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint.
The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-02-05
Published