CVE-2017-12303 Security feature bypass in Cisco Web Security Appliance

What is CVE-2017-12303?

CVE-2017-12303 is a medium-severity vulnerability in Cisco Asyncos, published on 16 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Advanced Malware Protection (AMP) file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass a configured AMP file filtering rule. The file types affected are zipped or archived file types. The vulnerability is due to incorrect and different file hash values when AMP scans the file. An attacker could exploit this vulnerability by sending a crafted email file attachment through the targeted device. An exploit could allow the attacker to bypass a configured AMP file filter. Cisco Bug IDs: CSCvf52943.

Weakness: CWE-358

Which versions are affected by CVE-2017-12303?

It affects 1 product.

Products include Cisco Asyncos.

How do I fix CVE-2017-12303?

No fix has been published for CVE-2017-12303 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-12303 being exploited?

There is no known exploitation of CVE-2017-12303 in the wild and no public exploit code.

Other vulnerabilities in Cisco Asyncos

• CVE-2025-20393 Cisco Multiple Products Improper Input Validation Exploited Critical 10.0
• CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Exploited Critical 9.8
• CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Exploited Critical 9.8
• CVE-2024-20435 Command injection in Cisco Secure Web Appliance High 8.8
• CVE-2019-15956 Cisco Web Security Appliance Unauthorized Device Reset Vulnerability High 8.8

All Cisco Asyncos vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3hr9-5q4c-rq22.