FKIE_CVE-2025-20185
Vulnerability from fkie_nvd - Published: 2025-02-05 17:15 - Updated: 2025-08-06 16:53
Severity ?
3.4 (Low) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials.
This vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this vulnerability by generating a temporary password for the service account. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system.
Note: The Security Impact Rating (SIR) for this vulnerability is Medium due to the unrestricted scope of information that is accessible to an attacker.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asyncos:13.0.0-392:*:*:*:*:*:*:*",
"matchCriteriaId": "FFEE94BE-6A3A-4873-BFCF-93E550F099A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:13.0.5-007:*:*:*:*:*:*:*",
"matchCriteriaId": "A787134E-F72F-4543-8F0E-3125A982BE3B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:13.5.1-277:*:*:*:*:*:*:*",
"matchCriteriaId": "E8E06464-FA10-4AA0-8320-FED11EF0B5ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:13.5.4-038:*:*:*:*:*:*:*",
"matchCriteriaId": "B6B6F533-7521-4DC1-8481-034E6CDE22DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.0.0-698:*:*:*:*:*:*:*",
"matchCriteriaId": "6A48B45C-E1B4-4524-A095-631C408044A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.2.0-620:*:*:*:*:*:*:*",
"matchCriteriaId": "A84B29E7-CB57-4DA8-BA2F-77AA4DB9C394",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.2.1-020:*:*:*:*:*:*:*",
"matchCriteriaId": "189C0A83-6BF1-45AD-ACC1-FB7561B901A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.3.0-032:*:*:*:*:*:*:*",
"matchCriteriaId": "6B09FBBD-C6BD-4BBD-8DF4-416D59E1E97C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:15.0.0-104:*:*:*:*:*:*:*",
"matchCriteriaId": "943D850B-D6B1-4B02-BBF6-687C3FD80AAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:15.0.1-030:*:*:*:*:*:*:*",
"matchCriteriaId": "74FB1274-8F04-4A8A-986F-225BBA4553E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:15.0.3-002:*:*:*:*:*:*:*",
"matchCriteriaId": "E10CE9B3-6B35-49CB-8DB6-2AF2D4678417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:15.5.0-048:*:*:*:*:*:*:*",
"matchCriteriaId": "05560A50-4EF9-42E9-B8B3-FC99C77089B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:15.5.1-055:*:*:*:*:*:*:*",
"matchCriteriaId": "421FFF79-BA3D-4968-928C-6F792E9A34AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:15.5.2-018:*:*:*:*:*:*:*",
"matchCriteriaId": "700129D1-EEB8-4A05-9E32-7C425CAA54F1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m100v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C9613A5-B198-4AD2-BC74-F21ABAF79174",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m300v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "57831FD6-1CF3-4ABE-81BA-2576418F9083",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m600v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "67E804AE-4743-44AD-A364-504B0AB0D9BF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m170:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3057023B-AD68-4953-A780-75EA416A7B94",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m190:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B87164B6-4717-4968-86F7-C62EB677FC50",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m195:-:*:*:*:*:*:*:*",
"matchCriteriaId": "10BD81D0-D81A-4361-B4E8-D674732A2A33",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m380:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D28903F8-3C4D-4337-9721-CEC108A7E2D5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m390:-:*:*:*:*:*:*:*",
"matchCriteriaId": "84ACD394-2E45-4E8E-A342-AC57935C7038",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m390x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6112D56B-B68B-40B0-8EB9-3315533110C7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m395:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8A1198BC-C934-4C26-887D-D599E8128FD3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m680:-:*:*:*:*:*:*:*",
"matchCriteriaId": "10374BA0-E7DD-4930-8C58-251F98B75A11",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m690:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD265B49-C691-44B3-A505-DC704E80313C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m690x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E37CFC3A-1752-4C66-BD32-CFFA46C3E6AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m695:-:*:*:*:*:*:*:*",
"matchCriteriaId": "830693AC-A737-43B9-BBB4-E3A1C950C47F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials.\r\n\r\nThis vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this vulnerability by generating a temporary password for the service account. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system.\r\nNote: The Security Impact Rating (SIR) for this vulnerability is Medium due to the unrestricted scope of information that is accessible to an attacker."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la implementaci\u00f3n de la funcionalidad de acceso remoto de Cisco AsyncOS Software para Cisco Secure Email and Web Manager, Cisco Secure Email Gateway y Cisco Secure Web Appliance podr\u00eda permitir que un atacante local autenticado eleve los privilegios a superusuario. El atacante debe autenticarse con credenciales de administrador v\u00e1lidas. Esta vulnerabilidad se debe a una falla arquitect\u00f3nica en el algoritmo de generaci\u00f3n de contrase\u00f1as para la funcionalidad de acceso remoto. Un atacante podr\u00eda explotar esta vulnerabilidad generando una contrase\u00f1a temporal para la cuenta de servicio. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante ejecutar comandos arbitrarios como superusuario y acceder al sistema operativo subyacente. Nota: La calificaci\u00f3n de impacto de seguridad (SIR) para esta vulnerabilidad es media debido al alcance ilimitado de la informaci\u00f3n a la que puede acceder un atacante."
}
],
"id": "CVE-2025-20185",
"lastModified": "2025-08-06T16:53:52.867",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 2.5,
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-02-05T17:15:25.883",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-multi-yKUJhS34"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-250"
}
],
"source": "psirt@cisco.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…