This bug in Cisco Secure Email lets hackers waltz past security protections

Image Credit: Pixabay (Image credit: Pixabay)

A recently discovered flaw in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager allows threat actors to waltz past security protections and log into endpoints with non-default configurations, the company has confirmed.

An advisory published by Cisco revealed the company stumbled upon the flaw while addressing a support case via Cisco TAC. While it claims there is no evidence of the flaw being exploited in the wild, it is now being tracked as CVE-2022-20798.

The good news is that a patch is already available, and users are urged to apply it immediately.

Unauthorized access

It revolves around authentication checks on endpoints using Lightweight Directory Access Protocol (LDAP) for external authentication, the company said. Allegedly, it only affects appliances configured to use external authentication, and LDAP. These things are turned off by default, though.

"An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device," Cisco says. "A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device."

> Cisco warns of new bug that could let hackers run off with admin credentials

> Cisco will not patch serious security hole in its old VPN routers

> Cisco tells firewall users to update now or potentially miss vital security updates

Users can check if their appliance has external authentication enabled by logging into the web-based management interface, navigating to System Administration > Users, and looking for “Enable External Authentication”.

Even though installing the patch is the best way to mitigate the threat, there are other workarounds, including disabling anonymous binds on the external authentication server.

This is not the first time Cisco has had to patch Secure Email gateway. Earlier this year, it fixed a flaw that allowed remote attackers to break unpatched appliances with the help of malicious emails.

Cisco also said it will not be fixing a zero-day found in RV110W, RV130, RV130W, and RV215W SMB routers, as these devices have reached end-of-life, BleepingComputer found. Businesses using these endpoints could be at risk, given that the zero-day allows attackers to execute arbitrary code with root-level privileges.

Via: BleepingComputer

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.