Critical Flaw in Cisco Secure Email and Web Manager Lets Attackers Bypass Authentication

Cisco on Wednesday rolled out fixes to address a critical security flaw affecting Email Security Appliance and Secure Email and Web Manager that could be exploited by an unauthenticated, remote attacker to sidestep authentication.

Assigned the CVE identifier CVE-2022-20798, the bypass vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring system and stems from improper authentication checks when an affected device uses Lightweight Directory Access Protocol for external authentication.

“An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device,” Cisco noted in an advisory.

“A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.”

The flaw, which it said was identified during the resolution of a technical assistance center case, impacts ESA and Secure Email and Web Manager running vulnerable AsyncOS software versions 11 and earlier, 12, 12.x, 13, 13.x, 14, and 14.x and when the following two conditions are met -.

Separately, Cisco also notified customers of another critical flaw affecting its Small Business RV110W, RV130, RV130W, and RV215W routers that could allow an unauthenticated, remote adversary to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service condition.

Share this article on social media:

Subscribe to Our Newsletter!

Stay on top of cybersecurity risks, evolving threats and industry news.

The Latest Cybersecurity News

From major cyberattacks, newly discovered critical vulnerabilities to recommended best practices, read it here first:

Tell us about your needs.
Get an answer the same business day.

Tell us about your needs.
Get an answer the same business day.

Fill out the form below and get an answer from our experts within 1 business day.
Got an urgent request? Call us at 1-877-805-7475 or Book a meeting.

What happens next:

  • We reach out to learn about your objectives
  • We work together to define your project's scope
  • You get an all-inclusive, no engagement proposal

Scroll to Top

BOOK A MEETING WITH AN EXPERT

Enter Your Corporate Email