5.3

CVE-2025-20183

Cisco Secure Web Appliance Range Request Bypass Vulnerability

A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint. 

The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Asyncos Version 11.8.0-414
Cisco ≫ Asyncos Version 11.8.0-429
Cisco ≫ Asyncos Version 11.8.0-453
Cisco ≫ Asyncos Version 11.8.1-023
Cisco ≫ Asyncos Version 11.8.3-018
Cisco ≫ Asyncos Version 11.8.3-021
Cisco ≫ Asyncos Version 11.8.4-004
Cisco ≫ Asyncos Version 12.0.1-268
Cisco ≫ Asyncos Version 12.0.1-334
Cisco ≫ Asyncos Version 12.0.2-004
Cisco ≫ Asyncos Version 12.0.2-012
Cisco ≫ Asyncos Version 12.0.3-005
Cisco ≫ Asyncos Version 12.0.3-007
Cisco ≫ Asyncos Version 12.0.4-002
Cisco ≫ Asyncos Version 12.0.5-011
Cisco ≫ Asyncos Version 12.5.1-011
Cisco ≫ Asyncos Version 12.5.1-043
Cisco ≫ Asyncos Version 12.5.2-007
Cisco ≫ Asyncos Version 12.5.2-011
Cisco ≫ Asyncos Version 12.5.3-002
Cisco ≫ Asyncos Version 12.5.4-005
Cisco ≫ Asyncos Version 12.5.4-011
Cisco ≫ Asyncos Version 12.5.5-004
Cisco ≫ Asyncos Version 12.5.5-005
Cisco ≫ Asyncos Version 12.5.5-008
Cisco ≫ Asyncos Version 12.5.6-008
Cisco ≫ Asyncos Version 14.0.1-014
Cisco ≫ Asyncos Version 14.0.1-040
Cisco ≫ Asyncos Version 14.0.1-053
Cisco ≫ Asyncos Version 14.0.1-503
Cisco ≫ Asyncos Version 14.0.2-012
Cisco ≫ Asyncos Version 14.0.3-014
Cisco ≫ Asyncos Version 14.0.4-005
Cisco ≫ Asyncos Version 14.0.5-007
Cisco ≫ Asyncos Version 14.1.0-032
Cisco ≫ Asyncos Version 14.1.0-041
Cisco ≫ Asyncos Version 14.1.0-047
Cisco ≫ Asyncos Version 14.5.0-498
Cisco ≫ Asyncos Version 14.5.0-537
Cisco ≫ Asyncos Version 14.5.0-673
Cisco ≫ Asyncos Version 14.5.1-008
Cisco ≫ Asyncos Version 14.5.1-016
Cisco ≫ Asyncos Version 14.5.1-510
Cisco ≫ Asyncos Version 14.5.1-607
Cisco ≫ Asyncos Version 14.5.2-011
Cisco ≫ Asyncos Version 14.5.3-033
Cisco ≫ Asyncos Version 15.0.0-322
Cisco ≫ Asyncos Version 15.0.0-355
Cisco ≫ Asyncos Version 15.1.0-287
Cisco ≫ Asyncos Version 15.2.0-116
Cisco ≫ Asyncos Version 15.2.0-164
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.354
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Cisco PSIRT 5.8 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swa-range-bypass-2BsEHYSu
Vendor Advisory