Alvaro Gutierrez

**Name of the Vulnerable Software and Affected Versions** Cisco Secure Web Appliance versions prior to 14.5.0-537 Cisco Secure Web Appliance versions 12.5 and 14.0 (updates pending) **Description** A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this by authenticating to the system and sending a crafted HTTP packet to the affected device, potentially allowing the execution of arbitrary commands on the underlying operating system and elevation of privileges to root. The attacker would need at least read-only credentials to successfully exploit this vulnerability. **Recommendations** For Cisco Secure Web Appliance version prior to 14.5.0-537, update to version 14.5.0-537 or later. For Cisco Secure Web Appliance versions 12.5 and 14.0, apply the pending updates as soon as they are available. As a temporary workaround, consider restricting access to the web management interface until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Cisco Web Security Appliance (affected versions not specified) Cisco Firepower Threat Defense (affected versions not specified) Snort detection engine (affected versions not specified) **Description** A vulnerability in Server Name Identification (SNI) request filtering could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This issue is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks. **Recommendations** For Cisco Web Security Appliance, consider disabling the SNI request filtering feature until a patch is available. For Cisco Firepower Threat Defense, restrict access to the SSL handshake to minimize the risk of exploitation. For Snort detection engine, avoid using the SSL client hello packet in the affected filtering technology until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Web Security Appliance (WSA) versions (affected versions not specified) **Description** A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This issue is due to insufficient validation of user-supplied XML input for the web interface. An attacker could exploit this by uploading crafted XML configuration files that contain scripting code to a vulnerable device, allowing the execution of arbitrary commands on the underlying operating system and elevation of privileges to root. The attacker would need a valid user account with the rights to upload configuration files to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Web Security Appliance (WSA) versions (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The issue exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this by inserting malicious data into a specific data field in an affected interface, potentially allowing the execution of arbitrary script code in the context of the affected interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.