FKIE_CVE-2025-20393
Vulnerability from fkie_nvd - Published: 2025-12-17 17:15 - Updated: 2026-01-16 14:00
Severity ?
Summary
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.
This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
References
Impacted products
{
"cisaActionDue": "2025-12-24",
"cisaExploitAdd": "2025-12-17",
"cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Cisco Multiple Products Improper Input Validation Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F7005EE5-0976-4E88-933F-C451D196C057",
"versionEndExcluding": "15.0.5-016",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "81772A3F-141D-4C3D-8094-1BD359D07C4A",
"versionEndExcluding": "15.5.4-012",
"versionStartIncluding": "15.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "32FF4E02-3750-4654-BD48-126133B33E6A",
"versionEndExcluding": "16.0.4-016",
"versionStartIncluding": "16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B6FBC8A-8187-4903-B786-6CF341C142B5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68864429-9730-43E9-96C3-20B9035BB291",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B52D8B2B-E9AE-4B02-87BD-9CF9FA95906A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7B1322B8-1CF9-4B17-9A58-38788051ED4F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:*",
"matchCriteriaId": "139A640B-1957-4953-AA88-9D373A5152D1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F08EA2AD-618B-4834-A52D-73F6A4502DF1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6893AE30-31DE-42CB-A463-E3DE22977107",
"versionEndExcluding": "15.0.2-007",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "12017942-B997-4FB1-B7FF-504EA72AC705",
"versionEndExcluding": "15.5.4-007",
"versionStartIncluding": "15.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F29F71EF-ED63-4DB2-A8BA-EB1E1A3BFF09",
"versionEndExcluding": "16.0.4-010",
"versionStartIncluding": "16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m100v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C9613A5-B198-4AD2-BC74-F21ABAF79174",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m300v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "57831FD6-1CF3-4ABE-81BA-2576418F9083",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m600v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "67E804AE-4743-44AD-A364-504B0AB0D9BF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m170:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3057023B-AD68-4953-A780-75EA416A7B94",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m190:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B87164B6-4717-4968-86F7-C62EB677FC50",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m195:-:*:*:*:*:*:*:*",
"matchCriteriaId": "10BD81D0-D81A-4361-B4E8-D674732A2A33",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m380:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D28903F8-3C4D-4337-9721-CEC108A7E2D5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m390:-:*:*:*:*:*:*:*",
"matchCriteriaId": "84ACD394-2E45-4E8E-A342-AC57935C7038",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m390x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6112D56B-B68B-40B0-8EB9-3315533110C7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m395:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8A1198BC-C934-4C26-887D-D599E8128FD3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m680:-:*:*:*:*:*:*:*",
"matchCriteriaId": "10374BA0-E7DD-4930-8C58-251F98B75A11",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m690:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD265B49-C691-44B3-A505-DC704E80313C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m690x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E37CFC3A-1752-4C66-BD32-CFFA46C3E6AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m695:-:*:*:*:*:*:*:*",
"matchCriteriaId": "830693AC-A737-43B9-BBB4-E3A1C950C47F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with\u0026nbsp;root privileges."
}
],
"id": "CVE-2025-20393",
"lastModified": "2026-01-16T14:00:12.647",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
},
"published": "2025-12-17T17:15:48.523",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…