Vulnerability in Cisco Asyncos
CVE-2023-20057
A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
EPSS: 0.007 (49.9th percentile) — read the EPSS interpretation.
Affected products
- Cisco Asyncos
- Cisco Email Security Appliance (Esa) — versions 10.0.1-087
- Cisco Email_security_appliance_c160
- Cisco Email_security_appliance_c170
- Cisco Email_security_appliance_c190
- Cisco Email_security_appliance_c370
- Cisco Email_security_appliance_c370d
- Cisco Email_security_appliance_c380
- Cisco Email_security_appliance_c390
- Cisco Email_security_appliance_c670
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-20057?
- CVE-2023-20057 is a vulnerability in Cisco Asyncos, classified under CWE-792. Published 2023-01-20.
- Is CVE-2023-20057 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.