CVE-2015-6298
HighSummary
The admin web interface in Cisco AsyncOS 8.x before version 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote authenticated users to obtain root privileges via crafted certificate-generation arguments.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the system, posing a serious threat to the security of the organization's data and infrastructure.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability and to monitor access to the admin interface.
Other vulnerabilities in Cisco AsyncOS na urządzeniach Web Security Appliance (WSA)
See all- CVE-2016-6407High
Cisco AsyncOS through version 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously.
- CVE-2016-1382High
Cisco AsyncOS before version 8.5.3-069 and in versions 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests, allowing remote attackers to cause a denial of service (proxy-process reload) via a crafted request.
- CVE-2016-1380High
Cisco AsyncOS 8.0 before version 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a crafted HTTP POST request.
- CVE-2015-6292High
The proxy-cache implementation in Cisco AsyncOS before version 8.0.7-151, 8.5.2-004, 8.7.0-171-LD, and 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service via multiple proxy connections.
- CVE-2015-6293High
Cisco AsyncOS versions before 8.0.8-113, 8.1.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allow remote attackers to cause a denial of service (memory consumption) via multiple file-range requests.
Original NVD description (English source)
The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote authenticated users to obtain root privileges via crafted certificate-generation arguments, aka Bug ID CSCus83445.