Cisco fixed a critical Bypass Authentication flaw in Cisco ESA and Secure Email and Web Manager

Cisco addressed a critical bypass authentication flaw in Cisco Email Security Appliance (ESA) and Secure Email and Web Manager.

Cisco addressed a critical bypass authentication vulnerability affecting Email Security Appliance (ESA) and Secure Email and Web Manager. The flaw, tracked as CVE-2022-20798 (CVSS score 9.8), can be exploited by an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of a vulnerable device.

The vulnerability was discovered by IT giant during the resolution of a TAC support case.

The flaw could be easily exploited by entering a specific input on the login page of the affected device.

“A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device.” reads the advisory published by Cisco. “This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.”

Below are the impacted software releases:

Cisco AsyncOS Release	First Fixed Release
111 and earlier	Migrate to fixed release.
12	Migrate to fixed release.
12.8	Migrate to fixed release.
13.0	13.0.0-277
13.6	13.6.2-090
13.8	13.8.1-090
14.0	14.0.0-418
14.1	14.1.0-250

Email Security Appliance: CSCvy13453

Cisco AsyncOS Release	First Fixed Release
Earlier than 111	Migrate to fixed release.
11	Migrate to fixed release.
12	Migrate to fixed release.
13	Migrate to fixed release.
14	14.0.1-033

The good news is that Cisco PSIRT is not aware of any attacks in the wild exploiting this flaw:

Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS. I ask you to vote for me again (even if you have already done it), because this vote is for the final.

Please vote for Security Affairs and Pierluigi Paganini in every category that includes them (e.g. sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog”)

To nominate, please visit: 

https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco ESA)

[adrotate banner=”5″]

[adrotate banner=”13″]