SECUFOCUSNOW
Home›CVE index›CVE-2025-20393
CISA KEV · Known exploitedCritical

CVE-2025-20393

Cisco Multiple Products

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with&nbsp...

CVSS
10
EPSS
29.5%
98.0% percentile
CISA KEV
Listed
Published
2025.12.18
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability29.5%
Technical severityCVSS 10

Vulnerability overview

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with&nbsp...

Affected product and versions

Product
Cisco Multiple Products
Affected versions
14.0.0-698, 13.5.1-277, 13.0.0-392, 14.2.0-620, 13.0.5-007, 13.5.4-038, 14.2.1-020, 14.3.0-032, 15.0.0-104, 15.0.1-030, 15.5.0-048, 15.5.1-055, 15.5.2-018, 16.0.0-050, 15.0.3-002, 16.0.0-054, 15.5.3-022, 16.0.1-017, 13.6.2-023, 13.6.2-078
Fixed versions
15.0.5-016, 15.5.4-012, 16.0.4-016, 15.0.2-007, 15.5.4-007, 16.0.4-010

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Due date: 2025.12.24
  1. 1
    Identify

    Confirm that Cisco Multiple Products and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
CWE-20
KEV added
2025.12.17
Ransomware use
미확인