CVE-2020-3164: Cisco ESA, Cisco WSA, and Cisco SMA GUI Denial of Service Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-04 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated remote attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific HTTP request headers. An attacker could exploit this vulnerability by sending a malformed HTTP request to an affected device. A successful exploit could allow the attacker to trigger a prolonged status of high CPU utilization relative to the GUI process(es). Upon successful exploitation of this vulnerability, an affected device will still be operative, but its response time and overall performance may be degraded.

Affected products

Cisco Cloud Email Security: through 13.0.0-392
Cisco Content Security Management Appliance (SMA): before 13.6.0 — fixed in 13.6.0
Cisco Email Security Appliance (ESA): through 13.0.0-392
Cisco Web Security Appliance (WSA): through 12.0.1-268

How to fix

Upgrade to a fixed version: Cisco Content Security Management Appliance (SMA) 13.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3164 or the next vulnerability affects your stack