CVE-2017-6750: A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local...

Security readout for executives and security teams

Cisco WSA appliances running affected AsyncOS could contain static credentials. A remote unauthenticated person may authenticate to some web GUI areas, and a local unauthenticated person may log in with limited-user privileges. Because this is an authentication weakness on a security appliance, treat exposed or unmanaged WSA systems as business-sensitive until verified and updated. Exposure is likely limited to organizations operating Cisco Web Security Appliance hardware or virtual appliances, especially AsyncOS release 10.1.0-204 or nearby unverified builds. Internet-facing or broadly reachable management web GUI access would increase concern. Prioritize verification and remediation for any Cisco WSA managing web traffic or reachable from untrusted networks. The available evidence does not show active exploitation, but authentication bypass on a security appliance can undermine trust in a key control point. Mitigation focus: Identify all Cisco WSA hardware and virtual appliances in asset inventory.; Check AsyncOS versions against Cisco advisory guidance.; Upgrade affected systems to 10.5.1-270 or a vendor-recommended fixed release..

Prepared

Jun 12, 2026, 22:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.