5.3

CVE-2026-20152

Medienbericht

Cisco Secure Web Appliance Authentication Service Traffic Bypass Vulnerability

A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass authentication policy requirements.

This vulnerability is due to improper validation of user-supplied authentication input in HTTP requests. An attacker could exploit this vulnerability by sending HTTP requests that contain specific authentication requests to an affected device. A successful exploit could allow the attacker to bypass policy enforcement on the device. There is no direct impact to the Cisco Secure Web Appliance. However, as a result of exploiting this vulnerability, an attacker could send HTTP requests that should be restricted through the device.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt Cisco Secure Web Appliance
Default Statusunknown
Version 11.8.0-453
Status affected
Version 12.5.3-002
Status affected
Version 12.0.3-007
Status affected
Version 12.0.3-005
Status affected
Version 14.1.0-032
Status affected
Version 14.1.0-047
Status affected
Version 14.1.0-041
Status affected
Version 12.0.4-002
Status affected
Version 14.0.2-012
Status affected
Version 11.8.0-414
Status affected
Version 12.0.1-268
Status affected
Version 11.8.1-023
Status affected
Version 11.8.3-021
Status affected
Version 11.8.3-018
Status affected
Version 12.5.1-011
Status affected
Version 11.8.4-004
Status affected
Version 12.5.2-007
Status affected
Version 12.5.2-011
Status affected
Version 14.5.0-498
Status affected
Version 12.5.4-005
Status affected
Version 12.5.4-011
Status affected
Version 12.0.5-011
Status affected
Version 14.0.3-014
Status affected
Version 12.5.5-004
Status affected
Version 12.5.5-005
Status affected
Version 12.5.5-008
Status affected
Version 14.0.4-005
Status affected
Version 14.5.1-008
Status affected
Version 14.5.1-016
Status affected
Version 15.0.0-355
Status affected
Version 15.0.0-322
Status affected
Version 12.5.6-008
Status affected
Version 15.1.0-287
Status affected
Version 14.5.2-011
Status affected
Version 15.2.0-116
Status affected
Version 14.0.5-007
Status affected
Version 15.2.0-164
Status affected
Version 14.5.1-510
Status affected
Version 12.0.2-012
Status affected
Version 12.0.2-004
Status affected
Version 14.5.1-607
Status affected
Version 14.5.3-033
Status affected
Version 15.0.1-004
Status affected
Version 15.2.1-011
Status affected
Version 14.5.0-673
Status affected
Version 14.5.0-537
Status affected
Version 12.0.1-334
Status affected
Version 14.0.1-503
Status affected
Version 14.0.1-053
Status affected
Version 11.8.0-429
Status affected
Version 14.0.1-040
Status affected
Version 14.0.1-014
Status affected
Version 12.5.1-043
Status affected
Version 15.2.2-009
Status affected
Version 15.2.3-007
Status affected
Version 15.2.4-022
Status affected
Version 15.2.5-011
Status affected
Version 15.2.5-013
Status affected
Version 14.6.0-108
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.205
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@cisco.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-305 Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.