CVE-2016-1411 Other in Cisco AsyncOS

What is CVE-2016-1411?

CVE-2016-1411 is a medium-severity vulnerability in Cisco Email Security Appliance, published on 14 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Management Security Appliance (SMA) could allow an unauthenticated, remote attacker to impersonate the update server. More Information: CSCul88715, CSCul94617, CSCul94627. Known Affected Releases: 7.5.2-201 7.6.3-025 8.0.1-023 8.5.0-000 8.5.0-ER1-198 7.5.2-HP2-303 7.7.0-608 7.7.5-835 8.5.1-021 8.8.0-000 7.9.1-102 8.0.0-404 8.1.1-013 8.2.0-222. Known Fixed Releases: 8.0.2-069 8.0.2-074 8.5.7-042 9.1.0-032 8.5.2-027 9.6.1-019.

Weakness: CWE-310

Which versions are affected by CVE-2016-1411?

It affects 3 products.

Products include Cisco Content Security Management Appliance, Cisco Email Security Appliance, Cisco Web Security Appliance.

How do I fix CVE-2016-1411?

No fix has been published for CVE-2016-1411 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-1411 being exploited?

There is no known exploitation of CVE-2016-1411 in the wild and no public exploit code.

Other vulnerabilities in Cisco Email Security Appliance

• CVE-2014-2119 File upload in n/a High 8.5
• CVE-2015-6321 Denial of service in n/a High 7.8
• CVE-2013-5537 Denial of service in n/a High 7.8
• CVE-2016-2183 Weak cryptography in n/a High 7.5
• CVE-2013-3395 Cross-site request forgery in n/a Medium 6.8

All Cisco Email Security Appliance vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cf26-vfrc-6mw2.