Live › vulnerability › CVE-2025-20393
Go to dashboardCisco Secure Email Gateway, Secure Email, AsyncOS and Web Manager appliances have an input validation flaw that lets an attacker run arbitrary commands. The commands run as root on the underlying appliance OS, and CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco Multiple Products | vendor | – | – |
| cisco asyncos | vendor | < 15.0.5-016 | 15.0.5-016 |
| cisco asyncos | vendor | >= 15.5, < 15.5.4-012 | 15.5.4-012 |
| cisco asyncos | vendor | >= 16.0, < 16.0.4-016 | 16.0.4-016 |
| cisco asyncos | vendor | < 15.0.2-007 | 15.0.2-007 |
| cisco asyncos |
| vendor |
| >= 15.5, < 15.5.4-007 |
| 15.5.4-007 |
| cisco asyncos | vendor | >= 16.0, < 16.0.4-010 | 16.0.4-010 |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.
This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
This page as .md · .json · in your agent: get_signal("CVE-2025-20393")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.