« Volver al listado

CVE-2016-6458

Estado: ModificadaAlta (7.5)—

A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass content filters configured on an affected device. Email that should have been filtered could instead be forwarded by the device. This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to use a content filter for email attachments that are protected or encrypted. More Information: CSCva52546. Known Affected Releases: 10.0.0-125 9.7.1-066.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Email Security Appliance Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-6458",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Cisco AsyncOS 10.0.0-125 and 9.7.1-066",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco AsyncOS 10.0.0-125 and 9.7.1-066"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-11-19T03:03:01.383",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94074",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037182",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-esa",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94074",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037182",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-esa",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass content filters configured on an affected device. Email that should have been filtered could instead be forwarded by the device. This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to use a content filter for email attachments that are protected or encrypted. More Information: CSCva52546. Known Affected Releases: 10.0.0-125 9.7.1-066."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la funcionalidad de filtrado de contenido de Software Cisco AsyncOS para Cisco Email Security Appliances podría permitir a un atacante remoto no autenticado eludir los filtros de contenido configurados en un dispositivo afectado. El correo electrónico que debería haber sido filtrado podría ser reenviado por el dispositivo. Esta vulnerabilidad afecta a todas las versiones anteriores a la primera versión solucionada del Software de Cisco AsyncOS para Cisco Email Security Appliances, tanto dispositivos virtual como hardware, si el software está configurado para utilizar un filtro de contenido para archivos adjuntos de correo electrónico que son protegidos o cifrados. Más información: CSCva52546. Lanzamientos conocidos afectados: 10.0.0-125 9.7.1-066."
    }
  ],
  "lastModified": "2026-06-17T00:51:03.927",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.1-066:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F09AFAB-9F02-4B39-8117-BAA56A434289"
            },
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-046:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "643A1573-29B5-4DD4-94D5-AF64ACCDFF11"
            },
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-047:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD833960-F2F6-4F48-BBA6-0FC77D3A1A6B"
            },
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:9.7.2-054:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB717827-4F97-4697-A991-4522558BE51F"
            },
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:9.9.6-026:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0958602-8C88-4E0E-8720-F4D7AB7692AD"
            },
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:9.9_base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BED571D-4B55-4526-8055-0848F27F1ACC"
            },
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.0-124:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61539DE3-591F-4CAA-889B-654037A07DC4"
            },
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.0-125:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C4E4BBD-F14C-4573-B771-FA0303A6220C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}