Vulnerability in Cisco Asyncos
CVE-2023-20057
A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
Published · last modified .
EPSS exploit prediction
EPSS: 0.007 (51.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 51.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Cisco Asyncos
- Cisco Email Security Appliance (Esa) — versions 10.0.1-087
- Cisco Email Security Appliance C160
- Cisco Email Security Appliance C170
- Cisco Email Security Appliance C190
- Cisco Email Security Appliance C370
- Cisco Email Security Appliance C370d
- Cisco Email Security Appliance C380
- Cisco Email Security Appliance C390
- Cisco Email Security Appliance C670
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2023-20057?
- CVE-2023-20057 is a vulnerability in Cisco Asyncos, classified under CWE-792. Published 2023-01-20.
- Is CVE-2023-20057 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.