CVE-2025-20183 describes a vulnerability in Cisco AsyncOS Software for Cisco Secure Web Appliance, specifically impacting its policy-based Application Visibility and Control (AVC) implementation. An unauthenticated, remote attacker can exploit this flaw by sending a crafted HTTP range request header, bypassing the antivirus scanner. This allows malicious files to be downloaded onto endpoints undetected, with a CVSS score of 5.3 (Medium). While the vulnerability has a low EPSS score and no known exploit code or active exploitation, it poses a risk of malware delivery. There is currently no community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
11.8.0-414CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:11.8.0-414:*:*:*:*:*:*:* | ||
11.8.0-429CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:11.8.0-429:*:*:*:*:*:*:* | ||
11.8.0-453CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:11.8.0-453:*:*:*:*:*:*:* | ||
11.8.1-023CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:11.8.1-023:*:*:*:*:*:*:* | ||
11.8.3-018CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:11.8.3-018:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.