June 16, 2022

Cisco has warned of a critical vulnerability known as CVE-2022-20798 and is asking customers to patch their systems.

The vulnerability was found in the external authentication functionality of the virtual and hardware Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager appliances.

The vulnerability could allow an attacker to bypass authentication and log into the web management interface of Cisco e-mail gateway appliances with non-default configurations.

The security firm reported that the vulnerability was discovered during the resolution of a Cisco TAC (Technical Assistance Center) support case and that no known public exploits or malicious exploits have been found.

Further analysis revealed that the bug only affects devices that are configured to use external authentication and LDAP as the authentication protocol. Cisco explained that the external authentication feature is disabled by default, which means that only devices with non-default configurations are impacted.

Those who cannot install CVE-2022-20798 security updates immediately should use a workaround that disables anonymous binds on the external authentication server.

The sources for this piece include an article in BleepingComputer.