A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA)…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor (L4TM) functionality and bypass security protections. The vulnerability is due to a change in the underlying operating system software that is responsible for monitoring affected traffic. An attacker could exploit this vulnerability by sending crafted IP packets to an affected device. A successful exploit could allow the attacker to pass traffic through the device, which the WSA was configured to deny. This vulnerability affects both IPv4 and IPv6 traffic. This vulnerability affects Cisco AsyncOS versions for WSA on both virtual and hardware appliances running any release of the 10.5.1, 10.5.2, or 11.0.0 WSA Software. The WSA is vulnerable if it is configured for L4TM. Cisco Bug IDs: CSCvg78875.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Web Security Appliance unknown | Cisco Web Security Appliance unknown | — | No fix listed | CNA |
- Cisco Web Security Appliance unknown Vendor— Affected Cisco Web Security Appliance unknown Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:web_security_appliance:10.5.1:*:*:*:*:*:*:* | 10.5.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:web_security_appliance:10.5.1-296:*:*:*:*:*:*:* | 10.5.1-296 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:web_security_appliance:10.5.2:*:*:*:*:*:*:* | 10.5.2 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:web_security_appliance:11.0.0:*:*:*:*:*:*:* | 11.0.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:web_security_appliance:11.5.0-fcs-442:*:*:*:*:*:*:* | 11.5.0-fcs-442 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:web_security_appliance:10.5.1:*:*:*:*:*:*:* Versions 10.5.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:web_security_appliance:10.5.1-296:*:*:*:*:*:*:* Versions 10.5.1-296 Vulnerable ·Cisco
- cpe:2.3:a:cisco:web_security_appliance:10.5.2:*:*:*:*:*:*:* Versions 10.5.2 Vulnerable ·Cisco
- cpe:2.3:a:cisco:web_security_appliance:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:web_security_appliance:11.5.0-fcs-442:*:*:*:*:*:*:* Versions 11.5.0-fcs-442 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-0353
- 2026-10-03 Alias added: GHSA-jh9h-rrv2-x586
References
More Cisco Web Security Appliance vulnerabilities
- TI-2023-06741 Buffer overflow in Cisco Secure Web Appliance CVSS 3.1CRITICAL 9.8
- TI-2018-00369 Uncontrolled resource consumption in Cisco AsyncOS Software for Cisco Web Security… CVSS 3.0HIGH 8.6
- TI-2019-01508 Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2021-01086 Cisco Web Security Appliance Privilege Escalation Vulnerability CVSS 3.1HIGH 8.8
- TI-2019-11999 Cisco Web Security Appliance Unauthorized Device Reset Vulnerability CVSS 3.1HIGH 8.8
- TI-2019-01440 Cisco Web Security Appliance Malformed Request Denial of Service Vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2018-0353 · CVE Program
- CVE-2018-0353 · NVD
- FIRST EPSS
- GHSA-jh9h-rrv2-x586 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences