CVE-2025-20183
Description
A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint. The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco asyncos | 11.8.0-414, 11.8.0-429, 11.8.0-453, 11.8.1-023, 11.8.3-018, 11.8.3-021, 11.8.4-004, 12.0.1-268, 12.0.1-334, 12.0.2-004, 12.0.2-012, 12.0.3-005, 12.0.3-007, 12.0.4-002, 12.0.5-011, 12.5.1-011, 12.5.1-043, 12.5.2-007, 12.5.2-011, 12.5.3-002, 12.5.4-005, 12.5.4-011, 12.5.5-004, 12.5.5-005, 12.5.5-008, 12.5.6-008, 14.0.1-014, 14.0.1-040, 14.0.1-053, 14.0.1-503, 14.0.2-012, 14.0.3-014, 14.0.4-005, 14.0.5-007, 14.1.0-032, 14.1.0-041, 14.1.0-047, 14.5.0-498, 14.5.0-537, 14.5.0-673, 14.5.1-008, 14.5.1-016, 14.5.1-510, 14.5.1-607, 14.5.2-011, 14.5.3-033, 15.0.0-322, 15.0.0-355, 15.1.0-287, 15.2.0-116, 15.2.0-164 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.