Cisco Secure Web Appliance Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in Cisco AsyncOS Software for Cisco Secure Web Appliance. This vulnerability allows an unauthenticated, remote attacker to bypass authentication policy requirements. The issue arises from improper validation of user-supplied authentication input in HTTP requests. Exploitation of this vulnerability could enable an attacker to send HTTP requests that should be restricted, effectively bypassing policy enforcement on the device.

Impact

Exploitation of this vulnerability could allow an attacker to send unauthorized HTTP requests through the affected device, potentially accessing or manipulating resources that should be restricted.

Remediation

Cisco has released software updates to address this vulnerability. Users are advised to upgrade to version 15.2.5-013 or later. For versions earlier than 15.2, users should migrate to a fixed release. Instructions for obtaining the updated software can be found on the Cisco Support and Downloads page.