CVE-2021-1566— Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
Quick assessment
Affected
Cisco Cisco Web Security Appliance (WSA)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Advanced Malware Protection（AMP）for Endpoints for Windows是美国思科（Cisco）公司的一款基于Windows平台的端点安全解决方案。该产品主要具有高级威胁预防、监测和响应等功能。 Cisco Advanced Malware Protection 存在安全漏洞，未经身份验证的远程攻击者可以拦截受影响设备和AMP之间的流量服务器，然后提取敏感信息或更改某些API请求。
Possible ATT&CK Techniques 3 AI
T1041 · Exfiltration Over C2 Channel T1113 · Screen Capture T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-1566
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书信任链回溯不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Advanced Malware Protection 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Advanced Malware Protection（AMP）for Endpoints for Windows是美国思科（Cisco）公司的一款基于Windows平台的端点安全解决方案。该产品主要具有高级威胁预防、监测和响应等功能。 Cisco Advanced Malware Protection 存在安全漏洞，未经身份验证的远程攻击者可以拦截受影响设备和AMP之间的流量服务器，然后提取敏感信息或更改某些API请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Web Security Appliance (WSA) | n/a | - |
|
II. Public POCs for CVE-2021-1566
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-1566
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-1566 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-cert-vali-n8L97RW vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2021-06-16 · 11 CVEs total
| CVE-2021-1542 | 7.2 HIGH | Cisco Small Business 220 Series Smart Switches Vulnerabilities |
| CVE-2021-1543 | 7.2 HIGH | Cisco Small Business 220 Series Smart Switches Vulnerabilities |
| CVE-2021-1571 | 7.2 HIGH | Cisco Small Business 220 Series Smart Switches Vulnerabilities |
| CVE-2021-1541 | 7.2 HIGH | Cisco Small Business 220 Series Smart Switches Vulnerabilities |
| CVE-2021-1567 | 7.0 HIGH | Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL |
| CVE-2021-1569 | 6.5 MEDIUM | Cisco Jabber Desktop and Mobile Client Software Vulnerabilities |
| CVE-2021-1570 | 6.5 MEDIUM | Cisco Jabber Desktop and Mobile Client Software Vulnerabilities |
| CVE-2021-1568 | 5.5 MEDIUM | Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability |
| CVE-2021-1395 | 4.7 MEDIUM | Cisco Unified Intelligence Center Reflected Cross-Site Scripting Vulnerability |
| CVE-2021-1524 | 4.3 MEDIUM | Cisco Meeting Server API Denial of Service Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Web Security Appliance (WSA)
-
CVE-2023-20120
Cisco Secure Email Gateway, Cisco Secure Email and Web Manag -
CVE-2023-20028
Cisco Secure Email Gateway, Cisco Secure Email and Web Manag -
CVE-2022-20675
Multiple Cisco Security Products Simple Network Management P -
CVE-2022-20781
Cisco Web Security Appliance Stored Cross-Site Scripting Vul -
CVE-2022-20784
Cisco Web Security Appliance Filter Bypass Vulnerability
Same vendor: Cisco
-
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization B -
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-20121
CIsco FTD Bypass Access List -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability
Same weakness: CWE-296
-
CVE-2026-96770
s2s-proxy accepts untrusted client certificates -
CVE-2026-73542
Seiko Epson Printer 加密问题漏洞 -
CVE-2026-24066
Slate Digital Connect macOS XPC certificate validation privi -
CVE-2026-33779
Junos OS: SRX Series: Insufficient certificate verification -
CVE-2025-48057
Icinga 2 certificate renewal might incorrectly renew an inva
V. Comments for CVE-2021-1566
No comments yet