A flaw in the DVS Engine of Cisco Secure Web Appliance allows an unauthenticated, remote attacker to send a specially crafted archive file that the device fails to scan properly. The compromised anti‑malware scanner can be bypassed, allowing a malicious archive to be downloaded to an end‑user workstation. The malware does not execute automatically; it requires the user to extract and launch the file. This is a classic CWE‑494 problem where code or functionality is unintentionally exposed through improper validation.

The vulnerable component resides in Cisco AsyncOS Software used in Cisco Secure Web Appliance. Specific affected versions are not disclosed in the advisory, but all installations that include the DVS Engine and its archive handling routine should be considered potentially impacted. Refer to the Cisco advisory for version‑specific guidance.

The CVSS score of 4 reflects a moderate impact. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector remains remote and unauthenticated, requiring the attacker to push a crafted archive through the device. While the risk is moderate, the potential for delivering malware to end users makes it a priority for remediation.