Attackers Can Crash Cisco E-mail Safety Home equipment by Sending Malicious Emails

Cisco has launched safety updates to comprise three vulnerabilities affecting its merchandise, together with one high-severity flaw in its E-mail Safety Equipment (ESA) that might lead to a denial-of-service (DoS) situation on an affected gadget.

The weak point, assigned the identifier CVE-2022-20653 (CVSS rating: 7.5), stems from a case of inadequate error dealing with in DNS title decision that could possibly be abused by an unauthenticated, distant attacker to ship a specifically crafted e mail message and trigger a DoS.

“A profitable exploit may enable the attacker to trigger the gadget to change into unreachable from administration interfaces or to course of extra e mail messages for a time frame till the gadget recovers, leading to a DoS situation,” the corporate stated in an advisory. “Continued assaults may trigger the gadget to change into fully unavailable, leading to a persistent DoS situation.”

The flaw impacts Cisco ESA gadgets operating Cisco AsyncOS Software program operating variations 14.0, 13.5, 13.0, 12.5 and earlier and have the “DANE function enabled and with the downstream mail servers configured to ship bounce messages.” DANE is brief for DNS-based Authentication of Named Entities, which is used for outbound mail validation.

Cisco credited researchers from ICT service supplier Rijksoverheid Dienst ICT Uitvoering (DICTU) for reporting the vulnerability, whereas declaring that it is not discovered any proof of malicious exploitation.

Individually, the networking tools maker additionally addressed two different flaws in its Prime Infrastructure and Advanced Programmable Community Supervisor and Redundancy Configuration Supervisor that might allow an adversary to execute arbitrary code and trigger a DoS situation –

• CVE-2022-20659 (CVSS rating: 6.1) – Cisco Prime Infrastructure and Advanced Programmable Community Supervisor cross-site scripting (XSS) vulnerability
• CVE-2022-20750 (CVSS rating: 5.3) – Cisco Redundancy Configuration Supervisor for Cisco StarOS Software program TCP denial-of-service (DoS) vulnerability

The fixes additionally come weeks after Cisco revealed patches for a number of important safety vulnerabilities impacting its RV Sequence routers, a few of which earned the very best doable CVSS severity rating scores of 10, that could possibly be weaponized to raise privileges and execute arbitrary code on affected methods.