{
  "cisaActionDue": "2025-12-24",
  "cisaExploitAdd": "2025-12-17",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Cisco Multiple Products Improper Input Validation Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF5703ED-9ACE-47AA-986E-0481AD02A5E9",
              "versionEndIncluding": "16.0.3-044",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m100v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C9613A5-B198-4AD2-BC74-F21ABAF79174",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m300v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "57831FD6-1CF3-4ABE-81BA-2576418F9083",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m600v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "67E804AE-4743-44AD-A364-504B0AB0D9BF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B6FBC8A-8187-4903-B786-6CF341C142B5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "68864429-9730-43E9-96C3-20B9035BB291",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B52D8B2B-E9AE-4B02-87BD-9CF9FA95906A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m170:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3057023B-AD68-4953-A780-75EA416A7B94",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m190:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B87164B6-4717-4968-86F7-C62EB677FC50",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m195:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "10BD81D0-D81A-4361-B4E8-D674732A2A33",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m380:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D28903F8-3C4D-4337-9721-CEC108A7E2D5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m390:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "84ACD394-2E45-4E8E-A342-AC57935C7038",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m390x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6112D56B-B68B-40B0-8EB9-3315533110C7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m395:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A1198BC-C934-4C26-887D-D599E8128FD3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m680:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "10374BA0-E7DD-4930-8C58-251F98B75A11",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m690:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD265B49-C691-44B3-A505-DC704E80313C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m690x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E37CFC3A-1752-4C66-BD32-CFFA46C3E6AD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_and_web_manager_m695:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "830693AC-A737-43B9-BBB4-E3A1C950C47F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B1322B8-1CF9-4B17-9A58-38788051ED4F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "139A640B-1957-4953-AA88-9D373A5152D1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F08EA2AD-618B-4834-A52D-73F6A4502DF1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco is aware of a potential vulnerability.\u0026nbsp; Cisco is currently investigating and\u0026nbsp;will update these details as appropriate\u0026nbsp;as more information becomes available."
    }
  ],
  "id": "CVE-2025-20393",
  "lastModified": "2025-12-18T15:41:16.840",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-17T17:15:48.523",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "summary": "This attack campaign was initially found during the resolution of a Cisco TAC support case."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. The ongoing investigation has revealed evidence of a persistence mechanism planted by the threat actors to maintain a degree of control over compromised appliances.\r\n\r\nCisco strongly recommends that customers follow the guidance provided in the Recommendations  [\"#Recommendations\"]section of this advisory to assess exposure and mitigate risks.\r\n\r\nCisco Talos discussed these attacks in the blog post UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager [\"https://blog.talosintelligence.com/uat-9686/\"].\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Cisco continues to investigate this attack campaign. As the investigation progresses, Cisco will update this advisory as appropriate as more information becomes available.",
        "title": "Affected Products"
      },
      {
        "category": "general",
        "text": "This attack campaign affects Cisco Secure Email Gateway, both physical and virtual, and Cisco Secure Email and Web Manager appliances, both physical and virtual, when both of the following conditions are met:\r\n\r\nThe appliance is configured with the Spam Quarantine feature.\r\nThe Spam Quarantine feature is exposed to and reachable from the internet.\r\n\r\nThe Spam Quarantine feature is not enabled by default. Deployment guides for these products do not require this port to be directly exposed to the Internet.\r\n\r\nNote: All releases of Cisco AsyncOS Software are affected by this attack campaign.\r\n\r\nDetermine Whether Spam Quarantine Is Enabled on a Cisco Secure Email Gateway Appliance\r\n\r\nTo determine whether the Spam Quarantine feature is configured and enabled on an appliance, connect to the web management interface and navigate to the following menu: Network \u003e IP Interfaces \u003e [Select the Interface on which Spam Quarantine is configured]. If the checkbox next to Spam Quarantine is checked, the feature is enabled.\r\n\r\nDetermine Whether Spam Quarantine Is Enabled on a Cisco Secure Email and Web Manager Appliance\r\n\r\nTo determine whether the Spam Quarantine feature is configured and enabled on an appliance, connect to the web management interface and navigate to the following menu: Management Appliance \u003e Network \u003e IP Interfaces \u003e [Select the interface on which Spam Quarantine is configured]. If the checkbox next to Spam Quarantine is checked, the feature is enabled.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this attack campaign.\r\n\r\nCisco has confirmed that all devices that are part of Cisco Secure Email Cloud are not affected.\r\n\r\nCisco is not aware of any exploitation activity against Cisco Secure Web.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "As part of the attack campaign described in this advisory, the threat actor planted a persistent covert channel that was used to remotely access the compromised appliance.\r\n\r\nCustomers who wish to explicitly verify whether an appliance has been compromised can open a Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/index.html\"] case. To expedite our investigation into the potential compromise, please ensure that remote access is enabled on the affected appliances. For more guidance, see this tech note [\"https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117873-faq-esa-00.html\"].\r\n\r\nIn any case, Cisco strongly recommends following the guidance listed in the Recommendations [\"#Recommendations\"] section of this advisory.",
        "title": "Indicators of Compromise"
      },
      {
        "category": "general",
        "text": "There are no workarounds identified that directly mitigate the risk concerning this attack campaign, but administrators can view and follow the guidance provided in the Recommendations  [\"#Recommendations\"]section of this advisory.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "If an appliance has been identified as having the web management interface or the Spam Quarantine port exposed to and reachable from the internet, Cisco strongly recommends following a multi-step process to restore the appliance to a secure configuration, when possible. For additional information, see Useful Resources at the end of this section.\r\n\r\nIf restoring the appliance is not possible, Cisco recommends contacting TAC [\"https://www.cisco.com/c/en/us/support/index.html\"] to check whether the appliance has been compromised. In case of confirmed compromise, rebuilding the appliances is, currently, the only viable option to eradicate the threat actors persistence mechanism from the appliance.\r\n\r\nIn addition, Cisco strongly recommends restricting access to the appliance and implementing robust access control mechanisms to ensure that ports are not exposed to unsecured networks.\r\n\r\nGeneral Recommendations For Hardening\r\n\r\nPrevent access from the internet to the appliance. If internet access to the appliance is required, restrict appliance access to only known, trusted hosts on ports/protocols that are included in the user guides.\r\nProtect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances behind a filtering device such as a firewall, and filter traffic to/from the appliances while only allowing known, trusted hosts to send traffic to the appliances. Using a two-layer firewall can provide flexibility in network planning so that end users do not connect directly to the outer DMZ. See the Deployment sections of the User Guides for Cisco Secure Email Gateway [\"https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0-3/user_guide/b_ESA_Admin_Guide_16-0-3/b_ESA_Admin_Guide_12_1_chapter_010.html#con_1287954\"] and Cisco Secure Email and Web Manager [\"https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0-2/user_guide/b_sma_admin_guide_16_0_2/b_NGSMA_Admin_Guide_chapter_01.html#con_1257754\"].\r\nFor Cisco Secure Email Gateway, separate mail and management functionality onto separate network interfaces. This reduces the chance of unauthorized users accessing the internal Management Network. For more information, see the device user guides.\r\nRegularly monitor web log traffic for any unexpected traffic to/from appliances. Logging should be sent to an external server, if possible, and kept for a long enough duration so that post-event investigations can be performed with sufficient log data.\r\nDisable HTTP for the main administrator portal.\r\nDisable any network services that are not required, including HTTP and FTP. For more information about specific service functionality, see the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager user guides.\r\nUpgrade the appliance to the latest version of Cisco AsyncOS Software.\r\nUse a strong form of end-user authentication to the appliances, such as SAML or Lightweight Directory Access Protocol (LDAP). For more secure methods of authentication, see Authentication Options for End Users Accessing Spam Management Features [\"https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0-2/user_guide/b_sma_admin_guide_16_0_2/b_NGSMA_Admin_Guide_chapter_0101.html?bookSearch=true#con_1623537\"].\r\nChange the default administrator password to a more secure variant. Restrict access to the administrator account by creating user accounts based on necessary access requirements. In addition, create operator accounts for all administrators.\r\nUsing SSL/TLS, obtain an SSL certificate from a certificate authority (CA) or create a self-signed certificate.\r\n\r\nUseful Resources\r\n\r\nThe following resources can help restore an affected appliance to a secure state. Some of the documents are related to a specific product, but the procedures are mostly interchangeable. If customers have specific questions about a procedure, contact TAC. [\"https://www.cisco.com/c/en/us/support/index.html\"]\r\n\r\nTo download replacement Virtual Appliances, visit the relevant Cisco Software Download page:\r\n\r\nCisco Secure Email Gateway [\"https://software.cisco.com/download/home/284900944/type/282975113/release/16.0.1?i=!pp\"]\r\nCisco Secure Email and Web Manager [\"https://software.cisco.com/download/home/286283259/type/286283388/release/16.0.2?i=!pp\"]\r\n\r\nFor information about exporting reporting data from an appliance, see Working with Reports. [\"https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0/user_guide/b_sma_admin_guide_16_0/b_NGSMA_Admin_Guide_chapter_010.html\"]\r\n\r\nFor information about how to purge messages in the quarantine, see Spam Quarantine. [\"https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0/user_guide/b_sma_admin_guide_16_0/b_NGSMA_Admin_Guide_chapter_0101.html\"]\r\n\r\nFor additional information, see Centralizing Policy, Virus, and Outbreak Quarantines. [\"https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0/user_guide/b_ESA_Admin_Guide_16-0/b_ESA_Admin_Guide_12_1_chapter_0101011.html#con_1158787\"]",
        "title": "Recommendations"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "In December 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of potentially malicious activity that targets Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "This attack campaign was initially found during the resolution of a Cisco TAC support case.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT\r\n\r\nThe Cisco Support and Downloads [\"https://www.cisco.com/c/en/us/support/index.html\"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.\r\n\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories [\"https://www.cisco.com/go/psirt\"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"] or their contracted maintenance providers.\r\n    LEGAL DISCLAIMER DETAILS\r\n\r\nCISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nCopies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] for more information.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager",
        "url": "https://blog.talosintelligence.com/uat-9686/"
      },
      {
        "category": "external",
        "summary": "Cisco Technical Assistance Center (TAC)",
        "url": "https://www.cisco.com/c/en/us/support/index.html"
      },
      {
        "category": "external",
        "summary": "tech note",
        "url": "https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117873-faq-esa-00.html"
      },
      {
        "category": "external",
        "summary": "Cisco Secure Email Gateway",
        "url": "https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0-3/user_guide/b_ESA_Admin_Guide_16-0-3/b_ESA_Admin_Guide_12_1_chapter_010.html#con_1287954"
      },
      {
        "category": "external",
        "summary": "Cisco Secure Email and Web Manager",
        "url": "https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0-2/user_guide/b_sma_admin_guide_16_0_2/b_NGSMA_Admin_Guide_chapter_01.html#con_1257754"
      },
      {
        "category": "external",
        "summary": "Authentication Options for End Users Accessing Spam Management Features",
        "url": "https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0-2/user_guide/b_sma_admin_guide_16_0_2/b_NGSMA_Admin_Guide_chapter_0101.html?bookSearch=true#con_1623537"
      },
      {
        "category": "external",
        "summary": "Cisco Secure Email Gateway",
        "url": "https://software.cisco.com/download/home/284900944/type/282975113/release/16.0.1?i=!pp"
      },
      {
        "category": "external",
        "summary": "Cisco Secure Email and Web Manager",
        "url": "https://software.cisco.com/download/home/286283259/type/286283388/release/16.0.2?i=!pp"
      },
      {
        "category": "external",
        "summary": "Working with Reports.",
        "url": "https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0/user_guide/b_sma_admin_guide_16_0/b_NGSMA_Admin_Guide_chapter_010.html"
      },
      {
        "category": "external",
        "summary": "Spam Quarantine.",
        "url": "https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0/user_guide/b_sma_admin_guide_16_0/b_NGSMA_Admin_Guide_chapter_0101.html"
      },
      {
        "category": "external",
        "summary": "Centralizing Policy, Virus, and Outbreak Quarantines.",
        "url": "https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0/user_guide/b_ESA_Admin_Guide_16-0/b_ESA_Admin_Guide_12_1_chapter_0101011.html#con_1158787"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Cisco Technical Assistance Center (TAC)",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "considering software upgrades",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "the advisories",
        "url": "https://www.cisco.com/go/psirt"
      }
    ],
    "title": "Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager",
    "tracking": {
      "current_release_date": "2025-12-17T16:00:00+00:00",
      "generator": {
        "date": "2025-12-17T20:51:25+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-sma-attack-N9bf4",
      "initial_release_date": "2025-12-17T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2025-12-17T16:00:23+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        }
      ],
      "status": "interim",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Secure Email",
            "product": {
              "name": "Cisco Secure Email ",
              "product_id": "CSAFPID-189790"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Secure Email and Web Manager",
            "product": {
              "name": "Cisco Secure Email and Web Manager ",
              "product_id": "CSAFPID-189791"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-20393",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCws36549"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-189790",
          "CSAFPID-189791"
        ]
      },
      "release_date": "2025-12-17T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-189791",
            "CSAFPID-189790"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-189790",
            "CSAFPID-189791"
          ]
        }
      ],
      "title": "Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-20393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-17T17:15:48Z",
    "severity": "CRITICAL"
  },
  "details": "Cisco is aware of a potential vulnerability.\u0026nbsp; Cisco is currently investigating and\u0026nbsp;will update these details as appropriate\u0026nbsp;as more information becomes available.",
  "id": "GHSA-mrgj-cg36-fgq8",
  "modified": "2025-12-17T21:30:46Z",
  "published": "2025-12-17T18:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20393"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Cisco heeft een kwetsbaarheid in Cisco AsyncOS.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid bevindt zich in apparaten die gebruik maken van Cisco AsyncOS-software in combinatie met Cisco Secure Email Gateway en Cisco Secure Email en Web Manager. Voor uitbuiting is het noodzakelijk dat de service toegankelijk is vanaf het internet en de Spam Quarantine functie actief is, wat niet gebruikelijk is voor deze configuratie.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Cisco heeft nog geen updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie over mitigerende maatregelen.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
      }
    ],
    "title": "Kwetsbaarheid in Cisco AsyncOS",
    "tracking": {
      "current_release_date": "2025-12-17T19:47:00.346651Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2025-0398",
      "initial_release_date": "2025-12-17T19:47:00.346651Z",
      "revision_history": [
        {
          "date": "2025-12-17T19:47:00.346651Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Cisco Secure Email"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Cisco Secure Email and Web Manager"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-20393",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "description",
          "text": "Cisco is investigating a cyberattack campaign targeting appliances running Cisco AsyncOS Software, which may be vulnerable due to open ports.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-20393 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20393.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-20393"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco Secure Email Gateway avec fonctionnalit\u00e9 Spam Quarantine activ\u00e9e",
      "product": {
        "name": "Secure Email Gateway",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": " Cisco Secure Email and Web Manager avec fonctionnalit\u00e9 Spam Quarantine activ\u00e9e",
      "product": {
        "name": "Secure Email Gateway",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-20393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20393"
    }
  ],
  "initial_release_date": "2025-12-18T00:00:00",
  "last_revision_date": "2025-12-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-1120",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-12-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Cisco. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance avec les droits administrateurs.\n\nCisco indique que cette vuln\u00e9rabilit\u00e9 est activement exploit\u00e9e et fournit des recommandations dans son bulletin de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": "2025-12-17",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sma-attack-N9bf4",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"
    }
  ]
}