Cisco Secure Web Appliance Range Request Bypass (cisco-sa-swa-range-bypass-2BsEHYSu)

#TRUSTED 89a0eb4bbaaa3028b517b14ba5d36753bf2e998e4ab3912f0ee4bb7e05e82ccbbf92e54c16b4640d00df73eca5fac2d9f73735bf3be7e98620d3445ccfee1b51dcdb896ea642fdc6f0b01638b878dc1b7483426f8e38f27de941626d43b5c23b9a57d5fd96cb34449e3c0edbf249c8065eb7c3ec90f2c1b1aa3eee8a71577eb2b53adb5c933f1f68a59590c976c51197fb7a4df7eeb8d0e70484aa385674c99ab2858c3e2354f63fea1ecddae67f2a1c972d0e9dc5bd2261891756125f447d9208b7bac33adc3d2fa4d8816122ce4ae16ecc032e5a3bf62e978b661f32db6c4c92800cb73b0155df025c90db020b8a4b51b82961c4822eb8cd1ce0f59adec7cf199605576864f8b9960804526a54aa6cfc3721155a3c33df4d2a6c6c3526724baa4218b935ad940b9ea3c3246c63efca31ab8c7db81766c8032041e659c9f87c975c14f0f3ba622bcd5fc13879cb5aa5c0633e87fbf3518af7afe84db050d2e83cd3ce3ccddad37bc60af64b51c92c0b4b89a25c77d8d3edeba4eafb7d6327d12d6c4544d873c51a3458aadcef2726bd189e1e1072d36bff1ea908379c35bc8e9e34429561fb77efda18d9765be465f95647d09b6f187cb2af4786135d2bdb4fe22baa2835768979ac33980b1cf43bcdd6ca989d8a8224c99f60c6dbbb2996a27fad549dd939a42be09e7459ab63558d6a59f0b47bbe19b29d343db68fc2709a
#TRUST-RSA-SHA256 83d0682f6ae58dee1c961266ed194aad65f55af4cc2d19ee113eb437a8857f64223f3d15ecc69f2b904c2a3396fa1469ced4e456b32cd86e6901453d5c7e7ae2ee229b10fedca069d9c2d08ed2fe5891367fef3d979290b25475d07e08f497927ed840f412eca140bb95dd09deba493dc9423419f38b4911dff860729055d706791f9bc1bc40071a592899da79846ac686e08abd87c14b11e76bf2183583043883afd0e0566432ad119795d926ec77e208847ece732abd42ac56e5b17b0df108a62972cddb5cd24a5b76b2b84a0a343935d50acfd71cff640e136f2866fff3830df2f26ea350a4baf7714b563462cc96d0771ac01d489dd6d928188b006def67217d0542175ff3d2cd0b271e78d1286181bd1f8d1ec69315043c11f8eff8c1cbbc3fc5c058046d3d8b5a3dad402027143a4516a8037537956f0d987da7411644df178ee65978f142b3a5b1658bd1b3aa47fbca8f704f003cdac691bff0940b3d46817e36c960f7efdebde0a09a59b138c318a865d124ee56324345d021935e19ec44ad217ac3d3b3418552ddfddd73b11416c26027b13af4b2400e7e8132e44a286aa5c425191e999a1c970cd4bdf7ce64f119764ca1d34efbf26ba48650cc14fb1ed0579026356e99a48288c048624e574022348330c62378c6f2b679d4ec5a5d7cc78bf50733f2d2a2ce07ac18341ef9b0d2d8dae0f7607bfdfc415a71f3ba
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(215124);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-20183");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk58287");
  script_xref(name:"CISCO-SA", value:"cisco-sa-swa-range-bypass-2BsEHYSu");
  script_xref(name:"IAVA", value:"2025-A-0082-S");

  script_name(english:"Cisco Secure Web Appliance Range Request Bypass (cisco-sa-swa-range-bypass-2BsEHYSu)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Web Appliance Range Request Bypass is affected by a vulnerability.

  - A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco
    AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade
    the antivirus scanner and download a malicious file onto an endpoint. The vulnerability is due to
    improper handling of a crafted range request header. An attacker could exploit this vulnerability by
    sending an HTTP request with a crafted range request header through the affected device. A successful
    exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint
    without detection by Cisco Secure Web Appliance. (CVE-2025-20183)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swa-range-bypass-2BsEHYSu
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?302de8d0");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk58287");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk58287");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20183");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/02/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/07");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:secure_web_appliance_range_request_bypass");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_wsa_version.nasl");
  script_require_keys("Host/AsyncOS/Cisco Web Security Appliance/DisplayVersion", "Host/AsyncOS/Cisco Web Security Appliance/Version");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');


var product_info = cisco::get_product_info(name:'Cisco Web Security Appliance (WSA)');

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [ 
  WORKAROUND_CONFIG['range_request_download']
];

var constraints = [
  {'min_ver': '0.0', 'fix_ver': '15.0.1.004'},
  {'min_ver': '15.1', 'fix_ver': '15.2.1.011'}
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwk58287',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges: constraints,
  workarounds:workarounds,
  workaround_params: workaround_params
  );