Unscored severity · published Oct 19, 2014
CVE-2014-3381
The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote attackers to…
–
CVSS
1.7%
EPSS
No
On KEV
Description
The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote attackers to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asyncos · Cisco
through 8.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3381
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3381
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3381
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=36062
More from Asyncos
10.0
CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
9.8
CVE-2026-76519
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
9.8
CVE-2026-76461
Cisco Secure Email Gateway SQL Injection Vulnerability
8.8
CVE-2022-20871
A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an…
8.8
CVE-2022-20868
A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an…