CVE-2020-26082

Vulnerability

A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass content filters. The issue is due to improper handling of password-protected zip files [1]. Affected versions are Cisco ESA releases earlier than Release 13.5.2 [1].

Exploitation

An attacker can exploit this vulnerability by sending a malicious file inside a crafted zip-compressed file to an affected device [1]. No authentication is required, and the attacker only needs network access to send email to the target appliance.

Impact

Successful exploitation could allow the attacker to bypass configured content filters that would normally drop the email [1]. This could lead to delivery of malicious content that would otherwise be blocked, potentially compromising the confidentiality and integrity of the recipient's system.

Mitigation

Cisco has released software updates that address this vulnerability [1]. The fixed version is Release 13.5.2 and later. There are no workarounds [1].