Improper input validation in Cisco Email Security Appliance - CVE-2018-0447
Published: September 5, 2018 / Updated: September 7, 2018
Vulnerability identifier: #VU14696
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-0447
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to bypass security restrictions on the target system.
The vulnerability exists in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) due to incomplete input and validation checking mechanisms for certain Sender Policy Framework (SPF) messages that are sent to an affected device. A remote attacker can send a customized SPF packet, bypass the URL filters that are configured and pass through the device.
Affected software
Cisco Email Security Appliance
How to mitigate CVE-2018-0447
Install update from vendor's website.