CVE-2020-3546 Cisco Email Security Appliance Information Disclosure Vulnerability

Medium 5.3 Published 4 Sep 2020 Updated 13 Nov 2024

Unauthenticated remote attackers can obtain internal interface IP addresses via crafted requests to the web management interface of Cisco Email Security Appliances.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3546?

CVE-2020-3546 is a medium-severity vulnerability in Cisco Asyncos, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insufficient validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the interface of an affected device. A successful exploit could allow the attacker to obtain the IP addresses that are configured on the internal interfaces of the affected device. There is a workaround that addresses this vulnerability.

Weakness: CWE-20

Which versions are affected by CVE-2020-3546?

It affects 1 product.

Products include Cisco Asyncos.

How do I fix CVE-2020-3546?

No fix has been published for CVE-2020-3546 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3546 being exploited?

There is no known exploitation of CVE-2020-3546 in the wild and no public exploit code.

All Cisco Asyncos vulnerabilities

Sources

Also known as GHSA-9ggw-5jfc-f28m.