CVE-2016-6407: Cisco Web Security Appliance

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219.

Affected products

• Cisco Web Security Appliance: version 5.6.0-623 only; version 6.0.0-000 only; version 7.1.0 only; version 7.1.1 only; version 7.1.2 only; version 7.1.3 only; …

Published 2016-09-17. Last modified 2026-06-17.