QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-20183

Back to search

CVE-2025-20183

Published: Feb 5, 2025

Modified: Feb 5, 2025

PUBLISHED

CVSS v3.1

5.8

MEDIUM

Description

A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint.  The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.

VendorProductVersions

Cisco

Cisco Secure Web Appliance

affected
11.8.0-453
affected
12.5.3-002
affected
12.0.3-007
affected
12.0.3-005
affected
14.1.0-032

+46 more versions

Weaknesses (CWE)

CWE-20

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now