CVE-2016-1480 describes a bypass vulnerability in the MIME scanner of Cisco AsyncOS Software for Email Security Appliances (ESA) and Web Security Appliances (WSA). This flaw allows an unauthenticated, remote attacker to circumvent configured user filters designed to scan incoming email attachments. Affected products include various versions of Cisco ESA and WSA, both virtual and hardware appliances, prior to fixed releases like 9.1.1-038 and 9.7.1-066. The vulnerability carries a CVSSv3 score of 7.5 (High), indicating a critical severity. Its vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) signifies that it can be exploited remotely over the network with low attack complexity and no user interaction, leading to high confidentiality impact. There is no evidence of active exploitation, nor are there known public exploit codes available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
8.0.1-023CPE matchmatch criteria | cpe:2.3:a:cisco:email_security_appliance:8.0.1-023:*:*:*:*:*:*:* | ||
8.0_baseCPE matchmatch criteria | cpe:2.3:a:cisco:email_security_appliance:8.0_base:*:*:*:*:*:*:* | ||
8.5.0-000CPE matchmatch criteria | cpe:2.3:a:cisco:email_security_appliance:8.5.0-000:*:*:*:*:*:*:* | ||
8.5.0-er1-198CPE matchmatch criteria | cpe:2.3:a:cisco:email_security_appliance:8.5.0-er1-198:*:*:*:*:*:*:* | ||
8.5.6-052CPE matchmatch criteria | cpe:2.3:a:cisco:email_security_appliance:8.5.6-052:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.