What it is
The gateway scans incoming attachments for malware before they reach anyone’s inbox. Cisco says the flaw is “due to improper handling of email attachments when the file reputation service is enabled.” An attacker sends an email with a crafted attachment; the gateway processes it; the attacker can then “write arbitrary files and execute commands with root privileges on the underlying operating system.”
That inverts the whole point of the box. The device that was supposed to stop malicious email becomes the attacker’s foothold, sitting in front of every message the company sends and receives.
Who is affected
- Companies that run their own Cisco Secure Email Gateway appliance or virtual appliance with Advanced Malware Protection and file reputation enabled. The NVD record lists affected releases across the 13.x, 14.x, 15.x and 16.0 lines.
- Most small businesses on Microsoft 365 or Google Workspace without a separate gateway are not affected by this one. Larger offices, law firms and medical groups that bought an IT provider’s email security package sometimes are.
What to ask your IT provider
- Does our email go through a Cisco gateway?If the answer is yes, or “IronPort,” keep going.
- Is it on a fixed release, and since when?Cisco’s advisory lists the fixed releases for each line. Get the version number and the install date in writing.
- Was it checked for signs of misuse?It was exploited before many gateways were patched. A careful provider looks for unexpected files and accounts on the device, not only installs the update.
Sources
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.