CVE-2016-1480

High

Published: 28/10/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A vulnerability in the MIME scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device.

Risk Assessment

The organization may be exposed to attacks that exploit this vulnerability to bypass email message filters, potentially leading to the delivery of malicious attachments.

Recommendation

It is recommended to update the software to a version that includes fixes for this vulnerability to secure the devices against potential attacks.

Other vulnerabilities in Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA)

CVE-2016-6372High
A vulnerability in email message and content filtering in Cisco AsyncOS for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) allows an unauthenticated, remote attacker to bypass filtering functionality. Emails that should have been quarantined could instead be processed.

Original NVD description (English source)

A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco ESA and Cisco WSA, both virtual and hardware appliances, if the software is configured with message or content filters to scan incoming email attachments. More Information: CSCuw03606, CSCux59734. Known Affected Releases: 8.0.0-000 8.5.6-106 9.0.0-000 9.1.0-032 9.6.0-042 9.5.0-444 WSA10.0.0-000. Known Fixed Releases: 9.1.1-038 9.7.1-066.