Cisco Secure Web Appliance up to 15.2.0-164 AVC improper authorization

Summaryinfo

A vulnerability classified as critical has been found in Cisco Secure Web Appliance. The impacted element is an unknown function of the component AVC. Performing a manipulation results in improper authorization. This vulnerability is identified as CVE-2025-20183. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Cisco Secure Web Appliance. This affects some unknown processing of the component AVC. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity. The summary by CVE is:

A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint.  The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.

The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2025-20183 since 10/10/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/05/2025). MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 215124 (Cisco Secure Web Appliance Range Request Bypass (cisco-sa-swa-range-bypass-2BsEHYSu)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (215124). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Cisco

Name

• Secure Web Appliance

Version

• 11.8.0-414
• 11.8.0-429
• 11.8.0-453
• 11.8.1-023
• 11.8.3-018
• 11.8.3-021
• 11.8.4-004
• 12.0.1-268
• 12.0.1-334
• 12.0.2-004
• 12.0.2-012
• 12.0.3-005
• 12.0.3-007
• 12.0.4-002
• 12.0.5-011
• 12.5.1-011
• 12.5.1-043
• 12.5.2-007
• 12.5.2-011
• 12.5.3-002
• 12.5.4-005
• 12.5.4-011
• 12.5.5-004
• 12.5.5-005
• 12.5.5-008
• 12.5.6-008
• 14.0.1-014
• 14.0.1-040
• 14.0.1-053
• 14.0.1-503
• 14.0.2-012
• 14.0.3-014
• 14.0.4-005
• 14.0.5-007
• 14.1.0-032
• 14.1.0-041
• 14.1.0-047
• 14.5.0-498
• 14.5.0-537
• 14.5.0-673
• 14.5.1-008
• 14.5.1-016
• 14.5.1-510
• 14.5.1-607
• 14.5.2-011
• 14.5.3-033
• 15.0.0-322
• 15.0.0-355
• 15.1.0-287
• 15.2.0-116
• 15.2.0-164

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion