According to its self-reported version, Cisco Secure Endpoint is affected by multiple vulnerabilities.

  - A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected     device. This vulnerability is due to improper boundary checks for content in PE files during scanning,     which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by     submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A     successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting     in a DoS condition on the affected software. (CVE-2026-20213)

  - A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected     device. This vulnerability is due to improper boundary checks for content in FSG files during scanning,     which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by     submitting a crafted file that contains portable executable content compressed with FSG to be scanned by     ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning     process to terminate, resulting in a DoS condition on the affected software. (CVE-2026-20214)

  - A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected     device. This vulnerability is due to improper boundary checks for content in 7z files during scanning,     which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by     submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A     successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting     in a DoS condition on the affected software. (CVE-2026-20215)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Detections

Analytics

Cisco Secure Endpoint Multiple ClamAV DoS (cisco-sa-clamav-88cFYyxR)

high Nessus Plugin ID 324975

Version 1.3