Vulnerabilities > CVE-2020-26082 - Unspecified vulnerability in Cisco Asyncos

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

cisco

NVD

Published: 2023-08-04

Updated: 2024-01-25

Summary

A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass content filters that are configured on an affected device. The vulnerability is due to improper handling of password-protected zip files. An attacker could exploit this vulnerability by sending a malicious file inside a crafted zip-compressed file to an affected device. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco Asyncos - Cisco Asyncos 7.1.1 Cisco Asyncos 7.1.2 Cisco Asyncos 7.1.3 Cisco Asyncos 7.1.4 Cisco Asyncos 7.1.5 Cisco Asyncos 7.1.5-102 Cisco Asyncos 7.3.1 Cisco Asyncos 7.3.2 Cisco Asyncos 7.5 Cisco Asyncos 7.5.1 Cisco Asyncos 7.5.2 Cisco Asyncos 7.5.2-101 Cisco Asyncos 7.6.1 Cisco Asyncos 7.6.1-101 Cisco Asyncos 7.6.2 Cisco Asyncos 7.6.3 Cisco Asyncos 7.8 Cisco Asyncos 8.0 Cisco Asyncos 8.0.1 Cisco Asyncos 8.0.2 Cisco Asyncos 8.5 Cisco Asyncos 8.5.5 Cisco Asyncos 8.5.6 Cisco Asyncos 8.5.7 Cisco Asyncos 9.0 Cisco Asyncos 9.1 Cisco Asyncos 9.1.1 Cisco Asyncos 9.1.1-005 Cisco Asyncos 9.1.2 Cisco Asyncos 9.5 Cisco Asyncos 9.6 Cisco Asyncos 9.6.0 Cisco Asyncos 9.7 Cisco Asyncos 9.7.0-125 Cisco Asyncos 9.7.1 Cisco Asyncos 9.7.2 Cisco Asyncos 9.7.2-065 Cisco Asyncos 9.8 Cisco Asyncos 9.8.1 Cisco Asyncos 10.0 Cisco Asyncos 10.0.0 Cisco Asyncos 10.0.1 Cisco Asyncos 10.0.2 Cisco Asyncos 10.0.3 Cisco Asyncos 10.1.0 Cisco Asyncos 10.1.1-230 Cisco Asyncos 10.1.1-234 Cisco Asyncos 10.1.1-235 Cisco Asyncos 10.1.2-036 Cisco Asyncos 10.1.3-054 Cisco Asyncos 10.1.4-007 Cisco Asyncos 10.5 Cisco Asyncos 10.5.1-296 Cisco Asyncos 10.5.5-005 Cisco Asyncos 11.0 Cisco Asyncos 11.0.0 Cisco Asyncos 11.0.1 Cisco Asyncos 11.0.1-161 Cisco Asyncos 11.0.2 Cisco Asyncos 11.0.2-044_Md Cisco Asyncos 11.0.3 Cisco Asyncos 11.0.3-251 Cisco Asyncos 11.1 Cisco Asyncos 11.1.0 Cisco Asyncos 11.1.1 Cisco Asyncos 11.1.2 Cisco Asyncos 11.1.2-023_Md Cisco Asyncos 11.1.3 Cisco Asyncos 11.5 Cisco Asyncos 11.5.2-020 Cisco Asyncos 11.5.3-016 Cisco Asyncos 11.7 Cisco Asyncos 11.7.0-406 Cisco Asyncos 11.7.0-407 Cisco Asyncos 11.7.0-418 Cisco Asyncos 11.7.1-006 Cisco Asyncos 11.7.1-020 Cisco Asyncos 11.7.1-049 Cisco Asyncos 11.7.2-011 Cisco Asyncos 11.8 Cisco Asyncos 11.8.0 Cisco Asyncos 11.8.0-414 Cisco Asyncos 11.8.1-023 Cisco Asyncos 11.8.2-009 Cisco Asyncos 11.8.3-018 Cisco Asyncos 11.8.3-021 Cisco Asyncos 12.0 Cisco Asyncos 12.0.0 Cisco Asyncos 12.0.1-268 Cisco Asyncos 12.0.2 Cisco Asyncos 12.0.3-005 Cisco Asyncos 12.0.3-007 Cisco Asyncos 12.0.5-011 Cisco Asyncos 12.1 Cisco Asyncos 12.1.0-085 Cisco Asyncos 12.5 Cisco Asyncos 12.5.0 Cisco Asyncos 12.5.0-059 Cisco Asyncos 12.5.0-633 Cisco Asyncos 12.5.1-011 Cisco Asyncos 12.5.2-007 Cisco Asyncos 12.5.4-005 Cisco Asyncos 12.5.5 Cisco Asyncos 12.5.5-004 Cisco Asyncos 12.7 Cisco Asyncos 13.0 Cisco Asyncos 13.0.0 Cisco Asyncos 13.0.4 Cisco Asyncos 13.5.0 Cisco Asyncos 13.5.1 Cisco Asyncos 13.5.1-277 Cisco Asyncos 13.5.2	181
Hardware	Cisco Cisco Email Security Appliance C170 - Cisco Email Security Appliance C190 - Cisco Email Security Appliance C380 - Cisco Email Security Appliance C390 - Cisco Email Security Appliance C680 - Cisco Email Security Appliance C690 - Cisco Email Security Appliance C690X -	7

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-zip-bypass-gbU4gtTg