Cisco Secure Email Gateway SQLi (cisco-sa-esa-inj-2bLVGmhX)

#TRUSTED 1c0689ea008a86e798fe3bc5fb1d5c5a6181a6f463f3b86943548232be2c0aa3a231282d461882af84710497b47418505c4f062849c9b99904802950bda734df289a130de9ac53646f9de7bba449a7c3fdd843b83c84b23dcff60817dd5cbd2c48b1b2ebb10876bb91065b9eb3e48fcef39769204daf348b6e7d944a423b26403b5d6f4e33422aa430b8559bd699db51e42da024cd20f7901f57637ec383caa09b57c44854e2ed266d6172aed2efaeec047873ba48d6d243ff14867c7766ed8677dd28c0cc9e05679b9cdb58b8c691bcd748f4ca497dc8146b454f7bc0af4519c2443307a02f2eeaf8b9873474a102960ef6ce34abfdb366e726e1f8273e7e17617dc78eddd169d7bb0e412d7f6c31d50e06268948b3c4192971089b9e564640730cfbe94077ae5524fbdce506ac7d7cc0f02aad388ca7224b79c089da29c057353d135167464c885c47510d34b5d75a17e88862017fc856760d8b6bb430ea08a85173ecbeb3a932eeb60beaf78afb58d07576d4897090a4128fb192616bd7372f590c3340a94404cd717e68d2033a1b958cacef0dfc1bdcd12d79f617ffe8eac970ba6ede624f38f66e448cf45c22df64a269a65de8a79defc193dc3b0eb928ca0800ff3db28770d2574e2f2b7e9432b02f79038f93863c1ee4c5e8796ae555fe08835d8a2a09c0d3fdb47505e45cb74e5061e7efcbd0d4d29103288fc35501
#TRUST-RSA-SHA256 51f0445ab0ac106ec4eac3557aff6d2b622bf632a6ef143635801722a12b83ef65b9c81aa4d0c7c4be21b2520ae51a599672f778b0f7f797640ea11026f054943e348665416d14174d5683036bc41b49dd4c66b89765b252f9059cdf008110fd51fe98acfdb0a7bbfa258d234d78dcef7e4239338aabd8406c8d3467383962644a658b8d568cf86763ec0a9b5f163bd1179c4ef2b3f1b5ccb56c8e4066dc197a70a26f138330842905d2a15532a8a0d95e5ecf50d00a97cb0743652b9deaf27b6e9c4410382e2e18707d8f595d072ca88e5ffbc0c1d03cba519cf8862f508950d950925b0b6bd80800b46cc964d72c00d64b9b59e678e6faafcc7a8e694ac6c9be01cb5870939b9d0a38e8fc7810c17c09b17f9cc89ba5b4c977704671c7e9e1a811d7089c7e6449ebd2942a428230eac5db37881a4b9943e2db5989ac7d9adabfd042c3e6ce75b71cc7d7c6cd1304f29923baac4cce323b86cf8015986dd86d3a68a469656c890e55dcd92600e7581a8791aafcc97a60c5adb593404be494ba2c56d882ef8359287208a9d41db9a445ceda50fb1fd398c29abf19bb50cb12e73da87263beb76efd35557a10bcc3123cb0a063443909bef2cc4d16359651e7ba430fe835147ffae43dfc3277c3418490a9927bc9a10e96bf46b857003fe41c7dcda7724241ef68282596fd072614a5e6a34569691bae051388186cdb155464cc
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346259);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/16");

  script_cve_id("CVE-2026-76461");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu56234");
  script_xref(name:"CISCO-SA", value:"cisco-sa-esa-inj-2bLVGmhX");

  script_name(english:"Cisco Secure Email Gateway SQLi (cisco-sa-esa-inj-2bLVGmhX)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Email Gateway is affected by a SQL injection vulnerability.

  - A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow
    an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying
    operating system. This vulnerability is due to insufficient validation in the email parsing logic. An
    attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL
    statements through an affected device. A successful exploit could allow the attacker to execute arbitrary
    SQL statements, leading to command execution with root privileges on the underlying operating system.
    (CVE-2026-76461)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b37c3cb0");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu56234");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu56234");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76461");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:email_security_appliance");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_esa_version.nasl");
  script_require_keys("Host/AsyncOS/Cisco Email Security Appliance/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco Email Security Appliance (ESA)');

var vuln_ranges = [
  {'min_ver' : '0', 'fix_ver' : '15.5.5.0141'},
  {'min_ver' : '16.0', 'fix_ver' : '16.0.4.3021'},
  {'min_ver' : '16.5', 'fix_ver' : '16.5.0.780'}
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwu56234',
  'sqli'          , TRUE,
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);