CVE-2025-20393 (GCVE-0-2025-20393)
Vulnerability from cvelistv5 – Published: 2025-12-17 16:47 – Updated: 2026-02-26 16:07Title
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
Summary
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.
This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-18 04:55 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/c… | |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Cisco | Cisco Secure Email |
Affected:
14.0.0-698
Affected: 13.5.1-277 Affected: 13.0.0-392 Affected: 14.2.0-620 Affected: 13.0.5-007 Affected: 13.5.4-038 Affected: 14.2.1-020 Affected: 14.3.0-032 Affected: 15.0.0-104 Affected: 15.0.1-030 Affected: 15.5.0-048 Affected: 15.5.1-055 Affected: 15.5.2-018 Affected: 16.0.0-050 Affected: 15.0.3-002 Affected: 16.0.0-054 Affected: 15.5.3-022 Affected: 16.0.1-017 |
guessed | |
| Cisco | Cisco Secure Email and Web Manager |
Affected:
13.6.2-023
Affected: 13.6.2-078 Affected: 13.0.0-249 Affected: 13.0.0-277 Affected: 13.8.1-052 Affected: 13.8.1-068 Affected: 13.8.1-074 Affected: 14.0.0-404 Affected: 12.8.1-002 Affected: 14.1.0-227 Affected: 13.6.1-201 Affected: 14.2.0-203 Affected: 14.2.0-212 Affected: 12.8.1-021 Affected: 13.8.1-108 Affected: 14.2.0-224 Affected: 14.3.0-120 Affected: 15.0.0-334 Affected: 15.5.1-024 Affected: 15.5.1-029 Affected: 15.5.2-005 Affected: 16.0.0-195 Affected: 15.5.3-017 Affected: 16.0.1-010 Affected: 15.0.1-035 Affected: 16.0.2-088 |
guessed |
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: b7d02c20-138f-45e3-92e6-5626f37c19f7
Exploited: Yes
Timestamps
First Seen: 2025-12-17
Asserted: 2025-12-17
Scope
Notes: KEV entry: Cisco Multiple Products Improper Input Validation Vulnerability | Affected: Cisco / Multiple Products | Description: Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2025-12-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): Please adhere to Cisco's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Cisco products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4 ; https://nvd.nist.gov/vuln/detail/CVE-2025-20393
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-20 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | Multiple Products |
| Due Date | 2025-12-24 |
| Date Added | 2025-12-17 |
| Vendorproject | Cisco |
| Vulnerabilityname | Cisco Multiple Products Improper Input Validation Vulnerability |
| Knownransomwarecampaignuse | Unknown |
References
Created: 2026-02-02 12:25 UTC
| Updated: 2026-02-06 07:17 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 1cd5e125-b622-4d6b-b868-0fb907fdcdcf
Exploited: Yes
Timestamps
First Seen: 2026-06-01
Asserted: 2026-06-01
Scope
Notes: KEVIntel entry: Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability | Affected: Cisco / Cisco Secure Email, Cisco Secure Email and Web Manager | CVSS: 10.0 (CRITICAL) | EPSS: 0.2906 | Used in malware: unknown | Not yet in CISA KEV: False
Evidence
Type: Public Report
Signal: Successful Exploitation
Confidence: 70%
Source: kevintel
Details
| Feed | KEVIntel (kevintel.com) |
|---|---|
| Title | Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability |
| Vendor | Cisco |
| Product | Cisco Secure Email, Cisco Secure Email and Web Manager |
| Added Date | 2026-06-01T10:46:29.170Z |
| Cvss Score | 10.0 |
| Epss Score | 0.2906 |
| Cvss Severity | CRITICAL |
| Epss Percentile | 0.97913 |
| Used In Malware | unknown |
| Ahead Of Cisa Kev |
|
| Not Yet In Cisa Kev | False |
References
Created: 2026-06-23 14:03 UTC
| Updated: 2026-07-10 06:14 UTC
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20393",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-18T04:55:22.327258Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-12-17",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T16:07:31.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Email",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "14.0.0-698"
},
{
"status": "affected",
"version": "13.5.1-277"
},
{
"status": "affected",
"version": "13.0.0-392"
},
{
"status": "affected",
"version": "14.2.0-620"
},
{
"status": "affected",
"version": "13.0.5-007"
},
{
"status": "affected",
"version": "13.5.4-038"
},
{
"status": "affected",
"version": "14.2.1-020"
},
{
"status": "affected",
"version": "14.3.0-032"
},
{
"status": "affected",
"version": "15.0.0-104"
},
{
"status": "affected",
"version": "15.0.1-030"
},
{
"status": "affected",
"version": "15.5.0-048"
},
{
"status": "affected",
"version": "15.5.1-055"
},
{
"status": "affected",
"version": "15.5.2-018"
},
{
"status": "affected",
"version": "16.0.0-050"
},
{
"status": "affected",
"version": "15.0.3-002"
},
{
"status": "affected",
"version": "16.0.0-054"
},
{
"status": "affected",
"version": "15.5.3-022"
},
{
"status": "affected",
"version": "16.0.1-017"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Email and Web Manager",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "13.6.2-023"
},
{
"status": "affected",
"version": "13.6.2-078"
},
{
"status": "affected",
"version": "13.0.0-249"
},
{
"status": "affected",
"version": "13.0.0-277"
},
{
"status": "affected",
"version": "13.8.1-052"
},
{
"status": "affected",
"version": "13.8.1-068"
},
{
"status": "affected",
"version": "13.8.1-074"
},
{
"status": "affected",
"version": "14.0.0-404"
},
{
"status": "affected",
"version": "12.8.1-002"
},
{
"status": "affected",
"version": "14.1.0-227"
},
{
"status": "affected",
"version": "13.6.1-201"
},
{
"status": "affected",
"version": "14.2.0-203"
},
{
"status": "affected",
"version": "14.2.0-212"
},
{
"status": "affected",
"version": "12.8.1-021"
},
{
"status": "affected",
"version": "13.8.1-108"
},
{
"status": "affected",
"version": "14.2.0-224"
},
{
"status": "affected",
"version": "14.3.0-120"
},
{
"status": "affected",
"version": "15.0.0-334"
},
{
"status": "affected",
"version": "15.5.1-024"
},
{
"status": "affected",
"version": "15.5.1-029"
},
{
"status": "affected",
"version": "15.5.2-005"
},
{
"status": "affected",
"version": "16.0.0-195"
},
{
"status": "affected",
"version": "15.5.3-017"
},
{
"status": "affected",
"version": "16.0.1-010"
},
{
"status": "affected",
"version": "15.0.1-035"
},
{
"status": "affected",
"version": "16.0.2-088"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with\u0026nbsp;root privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "In December 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of potentially malicious activity that targets Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T16:32:03.740Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-sma-attack-N9bf4",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
}
],
"source": {
"advisory": "cisco-sa-sma-attack-N9bf4",
"defects": [
"CSCws36549"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20393",
"datePublished": "2025-12-17T16:47:13.128Z",
"dateReserved": "2024-10-10T19:15:13.266Z",
"dateUpdated": "2026-02-26T16:07:31.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2025-20393",
"cwes": [
"CWE-20"
],
"dateAdded": "2025-12-17",
"dueDate": "2025-12-24",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Unknown",
"notes": "Please adhere to Cisco\u0027s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Cisco products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4 ; https://nvd.nist.gov/vuln/detail/CVE-2025-20393",
"product": "Multiple Products",
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.",
"vendorProject": "Cisco",
"vulnerabilityName": "Cisco Multiple Products Improper Input Validation Vulnerability"
},
"epss": {
"cve": "CVE-2025-20393",
"date": "2026-09-28",
"epss": "0.32392",
"percentile": "0.98279"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Email",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "14.0.0-698"
},
{
"status": "affected",
"version": "13.5.1-277"
},
{
"status": "affected",
"version": "13.0.0-392"
},
{
"status": "affected",
"version": "14.2.0-620"
},
{
"status": "affected",
"version": "13.0.5-007"
},
{
"status": "affected",
"version": "13.5.4-038"
},
{
"status": "affected",
"version": "14.2.1-020"
},
{
"status": "affected",
"version": "14.3.0-032"
},
{
"status": "affected",
"version": "15.0.0-104"
},
{
"status": "affected",
"version": "15.0.1-030"
},
{
"status": "affected",
"version": "15.5.0-048"
},
{
"status": "affected",
"version": "15.5.1-055"
},
{
"status": "affected",
"version": "15.5.2-018"
},
{
"status": "affected",
"version": "16.0.0-050"
},
{
"status": "affected",
"version": "15.0.3-002"
},
{
"status": "affected",
"version": "16.0.0-054"
},
{
"status": "affected",
"version": "15.5.3-022"
},
{
"status": "affected",
"version": "16.0.1-017"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Email and Web Manager",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "13.6.2-023"
},
{
"status": "affected",
"version": "13.6.2-078"
},
{
"status": "affected",
"version": "13.0.0-249"
},
{
"status": "affected",
"version": "13.0.0-277"
},
{
"status": "affected",
"version": "13.8.1-052"
},
{
"status": "affected",
"version": "13.8.1-068"
},
{
"status": "affected",
"version": "13.8.1-074"
},
{
"status": "affected",
"version": "14.0.0-404"
},
{
"status": "affected",
"version": "12.8.1-002"
},
{
"status": "affected",
"version": "14.1.0-227"
},
{
"status": "affected",
"version": "13.6.1-201"
},
{
"status": "affected",
"version": "14.2.0-203"
},
{
"status": "affected",
"version": "14.2.0-212"
},
{
"status": "affected",
"version": "12.8.1-021"
},
{
"status": "affected",
"version": "13.8.1-108"
},
{
"status": "affected",
"version": "14.2.0-224"
},
{
"status": "affected",
"version": "14.3.0-120"
},
{
"status": "affected",
"version": "15.0.0-334"
},
{
"status": "affected",
"version": "15.5.1-024"
},
{
"status": "affected",
"version": "15.5.1-029"
},
{
"status": "affected",
"version": "15.5.2-005"
},
{
"status": "affected",
"version": "16.0.0-195"
},
{
"status": "affected",
"version": "15.5.3-017"
},
{
"status": "affected",
"version": "16.0.1-010"
},
{
"status": "affected",
"version": "15.0.1-035"
},
{
"status": "affected",
"version": "16.0.2-088"
}
]
}
],
"source": "psirt@cisco.com"
}
],
"cisaActionDue": "2025-12-24",
"cisaExploitAdd": "2025-12-17",
"cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Cisco Multiple Products Improper Input Validation Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F7005EE5-0976-4E88-933F-C451D196C057",
"versionEndExcluding": "15.0.5-016",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "81772A3F-141D-4C3D-8094-1BD359D07C4A",
"versionEndExcluding": "15.5.4-012",
"versionStartIncluding": "15.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "32FF4E02-3750-4654-BD48-126133B33E6A",
"versionEndExcluding": "16.0.4-016",
"versionStartIncluding": "16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B6FBC8A-8187-4903-B786-6CF341C142B5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68864429-9730-43E9-96C3-20B9035BB291",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B52D8B2B-E9AE-4B02-87BD-9CF9FA95906A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7B1322B8-1CF9-4B17-9A58-38788051ED4F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:*",
"matchCriteriaId": "139A640B-1957-4953-AA88-9D373A5152D1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F08EA2AD-618B-4834-A52D-73F6A4502DF1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6893AE30-31DE-42CB-A463-E3DE22977107",
"versionEndExcluding": "15.0.2-007",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "12017942-B997-4FB1-B7FF-504EA72AC705",
"versionEndExcluding": "15.5.4-007",
"versionStartIncluding": "15.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F29F71EF-ED63-4DB2-A8BA-EB1E1A3BFF09",
"versionEndExcluding": "16.0.4-010",
"versionStartIncluding": "16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m100v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C9613A5-B198-4AD2-BC74-F21ABAF79174",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m300v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "57831FD6-1CF3-4ABE-81BA-2576418F9083",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m600v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "67E804AE-4743-44AD-A364-504B0AB0D9BF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m170:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3057023B-AD68-4953-A780-75EA416A7B94",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m190:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B87164B6-4717-4968-86F7-C62EB677FC50",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m195:-:*:*:*:*:*:*:*",
"matchCriteriaId": "10BD81D0-D81A-4361-B4E8-D674732A2A33",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m380:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D28903F8-3C4D-4337-9721-CEC108A7E2D5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m390:-:*:*:*:*:*:*:*",
"matchCriteriaId": "84ACD394-2E45-4E8E-A342-AC57935C7038",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m390x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6112D56B-B68B-40B0-8EB9-3315533110C7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m395:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8A1198BC-C934-4C26-887D-D599E8128FD3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m680:-:*:*:*:*:*:*:*",
"matchCriteriaId": "10374BA0-E7DD-4930-8C58-251F98B75A11",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m690:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD265B49-C691-44B3-A505-DC704E80313C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m690x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E37CFC3A-1752-4C66-BD32-CFFA46C3E6AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m695:-:*:*:*:*:*:*:*",
"matchCriteriaId": "830693AC-A737-43B9-BBB4-E3A1C950C47F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with\u0026nbsp;root privileges."
}
],
"id": "CVE-2025-20393",
"lastModified": "2026-06-17T08:41:39.983",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "psirt@cisco.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-20393",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-18T04:55:22.327258Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-12-17T17:15:48.523",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2026-03-27T08:53:53+00:00",
"cve": "CVE-2025-20393",
"id": "CVE-2025-20393",
"initial_release_date": "2025-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-20393.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20393",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-17T20:50:41.920501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-17T17:01:24.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Email",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "14.0.0-698"
},
{
"status": "affected",
"version": "13.5.1-277"
},
{
"status": "affected",
"version": "13.0.0-392"
},
{
"status": "affected",
"version": "14.2.0-620"
},
{
"status": "affected",
"version": "13.0.5-007"
},
{
"status": "affected",
"version": "13.5.4-038"
},
{
"status": "affected",
"version": "14.2.1-020"
},
{
"status": "affected",
"version": "14.3.0-032"
},
{
"status": "affected",
"version": "15.0.0-104"
},
{
"status": "affected",
"version": "15.0.1-030"
},
{
"status": "affected",
"version": "15.5.0-048"
},
{
"status": "affected",
"version": "15.5.1-055"
},
{
"status": "affected",
"version": "15.5.2-018"
},
{
"status": "affected",
"version": "16.0.0-050"
},
{
"status": "affected",
"version": "15.0.3-002"
},
{
"status": "affected",
"version": "16.0.0-054"
},
{
"status": "affected",
"version": "15.5.3-022"
},
{
"status": "affected",
"version": "16.0.1-017"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Email and Web Manager",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "13.6.2-023"
},
{
"status": "affected",
"version": "13.6.2-078"
},
{
"status": "affected",
"version": "13.0.0-249"
},
{
"status": "affected",
"version": "13.0.0-277"
},
{
"status": "affected",
"version": "13.8.1-052"
},
{
"status": "affected",
"version": "13.8.1-068"
},
{
"status": "affected",
"version": "13.8.1-074"
},
{
"status": "affected",
"version": "14.0.0-404"
},
{
"status": "affected",
"version": "12.8.1-002"
},
{
"status": "affected",
"version": "14.1.0-227"
},
{
"status": "affected",
"version": "13.6.1-201"
},
{
"status": "affected",
"version": "14.2.0-203"
},
{
"status": "affected",
"version": "14.2.0-212"
},
{
"status": "affected",
"version": "12.8.1-021"
},
{
"status": "affected",
"version": "13.8.1-108"
},
{
"status": "affected",
"version": "14.2.0-224"
},
{
"status": "affected",
"version": "14.3.0-120"
},
{
"status": "affected",
"version": "15.0.0-334"
},
{
"status": "affected",
"version": "15.5.1-024"
},
{
"status": "affected",
"version": "15.5.1-029"
},
{
"status": "affected",
"version": "15.5.2-005"
},
{
"status": "affected",
"version": "16.0.0-195"
},
{
"status": "affected",
"version": "15.5.3-017"
},
{
"status": "affected",
"version": "16.0.1-010"
},
{
"status": "affected",
"version": "15.0.1-035"
},
{
"status": "affected",
"version": "16.0.2-088"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with\u0026nbsp;root privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "In December 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of potentially malicious activity that targets Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T16:32:03.740Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-sma-attack-N9bf4",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
}
],
"source": {
"advisory": "cisco-sa-sma-attack-N9bf4",
"defects": [
"CSCws36549"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20393",
"datePublished": "2025-12-17T16:47:13.128Z",
"dateReserved": "2024-10-10T19:15:13.266Z",
"dateUpdated": "2026-01-15T16:32:03.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…