CVE-2015-6291

High

Published: 06/11/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

The vulnerability in Cisco AsyncOS before version 8.5.7-043 and 9.x before 9.1.1-023, as well as 9.5.x and 9.6.x before 9.6.0-046, involves mishandling malformed fields during email filtering. This allows remote attackers to cause a denial of service through a crafted attachment.

Risk Assessment

Organizations using Email Security Appliance (ESA) devices may be vulnerable to attacks that lead to memory exhaustion and consequently to email service unavailability.

Recommendation

It is recommended to update Cisco AsyncOS to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access attempts.

Other vulnerabilities in Cisco AsyncOS

CVE-2025-20393CriticalActively exploited
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. The issue is due to insufficient validation of HTTP requests by the Spam Quarantine feature.

Original NVD description (English source)

Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match filtering, which allows remote attackers to cause a denial of service (memory consumption) via a crafted attachment in an e-mail message, aka Bug ID CSCuv47151.