Unscored severity · published Nov 6, 2015
CVE-2015-6321
Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032,…
–
CVSS
2.8%
EPSS
No
On KEV
Description
Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005, and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug IDs CSCus79774, CSCus79777, and CSCzv95795.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Content Security Management Appliance · Cisco
7.8.0-328; 7.8.1-001; 7.9.0-201; 7.9.2-116; 8.0.1-031; 8.1.0-001; +10 more · source: NVD
ES
Email Security Appliance · Cisco
7.6.1-000; 7.6.3-000; 7.7.0-000; 7.7.1-000; 7.8.0-311; 8.5.6-052; +8 more · source: NVD
WS
Web Security Appliance · Cisco
5.6.0-623; 6.0.0-000; 7.5.0-000; 7.5.0-825; 7.5.1-000; 7.5.2-000; +4 more · source: NVD
Affected product
CS
Content Security Management Appliance
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6321
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-aos
www.securitytracker.com
http://www.securitytracker.com/id/1034060
www.securitytracker.com
http://www.securitytracker.com/id/1034061
More from Content Security Management Appliance
7.5
CVE-2016-2183
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which…
6.7
CVE-2021-1447
A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, local attacker to…
6.5
CVE-2021-1516
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and…
6.5
CVE-2020-3447
A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an…
6.5
CVE-2018-0140
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download…