Cisco Secure Endpoint up to 8.1.7.21512 ClamAV out-of-bounds

Summaryinfo

A vulnerability was found in Cisco Secure Endpoint. It has been declared as problematic. This vulnerability affects unknown code of the component ClamAV. Executing a manipulation can lead to out-of-bounds. This vulnerability appears as CVE-2025-20234. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Cisco Secure Endpoint. This vulnerability affects some unknown processing of the component ClamAV. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. CVE summarizes:

A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability was named CVE-2025-20234 since 10/10/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 240737 (SUSE SLES15 Security Update : clamav (SUSE-SU-2025:02119-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (240737) and CERT Bund (WID-SEC-2025-1362). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Open Source ClamAV
• Cisco Secure Endpoint
• cPanel cPanel/WHM

Productinfo

Vendor

• Cisco

Name

• Secure Endpoint

Version

• 1.6.0
• 1.7.0
• 1.8.0
• 1.8.1
• 1.8.4
• 1.9.0
• 1.9.1
• 1.10.0
• 1.10.1
• 1.10.2
• 1.11.0
• 1.11.1
• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5
• 1.12.6
• 1.12.7
• 1.13.0
• 1.13.1
• 1.13.2
• 1.14.0
• 1.14.1
• 1.15.2
• 1.15.3
• 1.15.4
• 1.15.6
• 1.16.0
• 1.16.1
• 1.16.2
• 1.16.3
• 1.17.0
• 1.18.1
• 1.21.0
• 1.21.2
• 1.22.4
• 1.24.1
• 1.24.2
• 1.24.4
• 6.0.7
• 6.0.9
• 6.1.5
• 6.1.7
• 6.1.9
• 6.2.1
• 6.2.3
• 6.2.5
• 6.2.9
• 6.2.19
• 6.3.1
• 6.3.3
• 6.3.5
• 6.3.7
• 7.0.5
• 7.1.1
• 7.1.5
• 7.2.3
• 7.2.5
• 7.2.7
• 7.2.11
• 7.2.13
• 7.3.1
• 7.3.3
• 7.3.5
• 7.3.9
• 8.1.3
• 8.1.3.21242
• 8.1.5
• 8.1.5.21322
• 8.1.7
• 8.1.7.21417
• 8.1.7.21512

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion