A flaw in Cisco Secure Web Appliance’s authentication service lets an unauthenticated attacker inject crafted HTTP authentication requests that the system fails to properly validate. The result is an ability to circumvent the device’s policy enforcement, allowing traffic that would normally be blocked to pass through. Although the appliance itself is not directly damaged, the vulnerability enables an attacker to misuse the device as a conduit for unauthorized traffic.

Cisco Secure Web Appliance running Cisco AsyncOS Software, with no specific version details reported. All deployments of this product are potentially affected until a patch is applied.

The CVSS score of 5.3 places the vulnerability in the medium severity range. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, indicating no public exploitation reports yet. The attack vector is inferred to be remote, unauthenticated HTTP interaction, requiring only the ability to send HTTP requests to the device. If exploited, it could allow policy‑evasion traffic, posing a moderate risk to network security.