CVE-2016-1382 describes a denial-of-service vulnerability in Cisco AsyncOS on Web Security Appliance (WSA) devices, specifically affecting versions before 8.5.3-069 and 8.6 through 8.8. The flaw stems from improper memory allocation for HTTP requests, allowing remote attackers to trigger a proxy-process reload via a crafted request. With a CVSS v3 score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low complexity and no user interaction, leading to a complete loss of availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the CISA KEV catalog, though it has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.6.0-623CPE matchmatch criteria | cpe:2.3:a:cisco:web_security_appliance_\(wsa\):5.6.0-623:*:*:*:*:*:*:* | ||
6.0.0-000CPE matchmatch criteria | cpe:2.3:a:cisco:web_security_appliance_\(wsa\):6.0.0-000:*:*:*:*:*:*:* | ||
7.1.0CPE matchmatch criteria | cpe:2.3:a:cisco:web_security_appliance_\(wsa\):7.1.0:*:*:*:*:*:*:* | ||
7.1.1CPE matchmatch criteria | cpe:2.3:a:cisco:web_security_appliance_\(wsa\):7.1.1:*:*:*:*:*:*:* | ||
7.1.2CPE matchmatch criteria | cpe:2.3:a:cisco:web_security_appliance_\(wsa\):7.1.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.