CVE-2024-20392 [Medium] | XSS in Asyncos

A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.31%	0.39%	+0.08%
2	2025-12-25	0.23%	0.31%	+0.07%
3	2025-08-07	—	0.23%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.31%

0.39%

+0.08%

2025-12-25

0.23%

0.31%

+0.07%

2025-08-07

—

0.23%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.1	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	2.8	2.7	[email protected]
6.1	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	2.8	2.7	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.1

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

2.8

2.7

[email protected]

6.1

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

2.8

2.7

[email protected]

Affected software / configurations for CVE-2024-20392

Vendor	Product	Version	Raw CPE
cisco	asyncos	11.0.3-238	cpe:2.3:o:cisco:asyncos:11.0.3-238:::::::*
cisco	asyncos	11.1.0-069	cpe:2.3:o:cisco:asyncos:11.1.0-069:::::::*
cisco	asyncos	11.1.0-128	cpe:2.3:o:cisco:asyncos:11.1.0-128:::::::*
cisco	asyncos	12.0.0-419	cpe:2.3:o:cisco:asyncos:12.0.0-419:::::::*
cisco	asyncos	12.1.0-071	cpe:2.3:o:cisco:asyncos:12.1.0-071:::::::*
cisco	asyncos	12.1.0-087	cpe:2.3:o:cisco:asyncos:12.1.0-087:::::::*
cisco	asyncos	12.1.0-089	cpe:2.3:o:cisco:asyncos:12.1.0-089:::::::*
cisco	asyncos	12.5.0-066	cpe:2.3:o:cisco:asyncos:12.5.0-066:::::::*
cisco	asyncos	12.5.3-041	cpe:2.3:o:cisco:asyncos:12.5.3-041:::::::*
cisco	asyncos	12.5.4-041	cpe:2.3:o:cisco:asyncos:12.5.4-041:::::::*
cisco	asyncos	13.0.0-392	cpe:2.3:o:cisco:asyncos:13.0.0-392:::::::*
cisco	asyncos	13.0.5-007	cpe:2.3:o:cisco:asyncos:13.0.5-007:::::::*
cisco	asyncos	13.5.1-277	cpe:2.3:o:cisco:asyncos:13.5.1-277:::::::*
cisco	asyncos	13.5.4-038	cpe:2.3:o:cisco:asyncos:13.5.4-038:::::::*
cisco	asyncos	14.0.0-698	cpe:2.3:o:cisco:asyncos:14.0.0-698:::::::*
cisco	asyncos	14.2.0-620	cpe:2.3:o:cisco:asyncos:14.2.0-620:::::::*
cisco	asyncos	14.2.1-020	cpe:2.3:o:cisco:asyncos:14.2.1-020:::::::*
cisco	asyncos	14.3.0-032	cpe:2.3:o:cisco:asyncos:14.3.0-032:::::::*
cisco	asyncos	15.0.0-104	cpe:2.3:o:cisco:asyncos:15.0.0-104:::::::*
cisco	asyncos	15.0.1-030	cpe:2.3:o:cisco:asyncos:15.0.1-030:::::::*
cisco	asyncos	15.5.0-048	cpe:2.3:o:cisco:asyncos:15.5.0-048:::::::*

References for CVE-2024-20392

URL	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-http-split-GLrnnOwS	Vendor Advisory

URL

CVE-2024-20392

Exploit prediction scoring system (EPSS) score for CVE-2024-20392

Common vulnerability scoring system (CVSS) metrics for CVE-2024-20392

Weakness enumeration for CVE-2024-20392

Affected software / configurations for CVE-2024-20392

References for CVE-2024-20392