CVE-2016-1480: High severity cisco email security appliance firmware vulnerability
A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco ESA and Cisco WSA, both virtual and hardware appliances, if the software is configured with message or content filters to scan incoming email attachments. More Information: CSCuw03606, CSCux59734. Known Affected Releases: 8.0.0-000 8.5.6-106 9.0.0-000 9.1.0-032 9.6.0-042 9.5.0-444 WSA10.0.0-000. Known Fixed Releases: 9.1.1-038 9.7.1-066.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1480?
CVE-2016-1480 has a medium severity rating, indicating that it poses a moderate risk to affected systems.
How do I fix CVE-2016-1480?
To fix CVE-2016-1480, upgrade the Cisco Email Security Appliance firmware to a version that addresses this vulnerability.
What products are affected by CVE-2016-1480?
CVE-2016-1480 affects multiple versions of Cisco Email Security Appliances and Web Security Appliances running specific versions of AsyncOS.
Can CVE-2016-1480 be exploited remotely?
Yes, CVE-2016-1480 can be exploited by an unauthenticated remote attacker to bypass user filters.
Is there a workaround for CVE-2016-1480?
Currently, the recommended action for CVE-2016-1480 is to upgrade the affected Cisco appliances to the latest firmware.