CVE-2021-1534: Input Validation
First published: Wed Oct 06 2021(Updated: )
A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco AsyncOS | <14.0.1 | |
| Cisco Email Security Appliance C170 | ||
| Cisco Email Security Appliance C190 | ||
| Cisco Email Security Appliance C380 | ||
| Cisco Email Security Appliance C390 | ||
| Cisco Email Security Appliance C680 | ||
| Cisco Email Security Appliance C690 | ||
| Cisco Email Security Appliance C690x |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-1534 vulnerability?
CVE-2021-1534 is a vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) that allows an unauthenticated, remote attacker to bypass URL reputation filters.
How does CVE-2021-1534 vulnerability occur?
CVE-2021-1534 vulnerability occurs due to improper processing of URLs in Cisco AsyncOS Software.
What is the severity level of CVE-2021-1534 vulnerability?
CVE-2021-1534 vulnerability has a severity level of 5.3 (medium).
Which Cisco products are affected by CVE-2021-1534 vulnerability?
Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) version up to 14.0.1 is affected by CVE-2021-1534 vulnerability.
How can I mitigate CVE-2021-1534 vulnerability?
To mitigate CVE-2021-1534 vulnerability, it is recommended to upgrade to a fixed software version provided by Cisco.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/cisco
- canonical/cisco asyncos
- canonical/cisco email security appliance c170
- canonical/cisco email security appliance c190
- canonical/cisco email security appliance c380
- canonical/cisco email security appliance c390
- canonical/cisco email security appliance c680
- canonical/cisco email security appliance c690
- canonical/cisco email security appliance c690x