This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes multiple vulnerabilities in its products
Cisco fixes several vulnerabilities in its products. The vulnerable products and their fixed versions can be found in the link for each vulnerability.
Allows an authenticated remote attacker with valid read-only privileges, by sending a crafted serialized Java object to the affected Cisco ISE API, to execute arbitrary commands on the device with root privileges [1].
The vulnerability is present in product:
- *:Cisco Identity Services Engine; <=3.0; >=3.1, <3.1P10; >=3.2, <3.2P7; >=3.3, <3.3P4
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2025-20124 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an authenticated remote attacker with valid read-only privileges, by sending a crafted HTTP request to a specific Cisco ISE API, to obtain sensitive information, change the node configuration and restart the device [1].
The vulnerability is present in product:
- *:Cisco Identity Services Engine; <=3.0; >=3.1, <3.1P10; >=3.2, <3.2P7; >=3.3, <3.3P4
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
More information:
- CVE-2025-20125 at cve.org, NVD
- CWE-285: Improper Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an authenticated remote attacker, by sending a crafted SNMP request in Cisco IOS and IOS XE software, to perform a DoS attack. To exploit the vulnerability via SNMPv3, the attacker must have valid credentials for the affected system [2].
The vulnerability is present in products:
- *:Cisco IOS Software; >=15.2E, <5.2(7)E12; >=15.5SY, <15.5(1)SY15; >=15.9M, <15.9(3)M11
- *:Cisco IOS XE Software; >=3.11E, <3.11.12E; >=16.12, <16.12.13; >=17.9, <17.9.7; >=17.12, <17.12.5; >=17.15, <17.15.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-20169 at cve.org, NVD
- CVE-2025-20170 at cve.org, NVD
- CVE-2025-20171 at cve.org, NVD
- CVE-2025-20172 at cve.org, NVD
- CVE-2025-20173 at cve.org, NVD
- CVE-2025-20174 at cve.org, NVD
- CVE-2025-20175 at cve.org, NVD
- CVE-2025-20176 at cve.org, NVD
- CWE-805: Buffer Access with Incorrect Length Value at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an unauthenticated remote attacker, using social engineering, to perform an XSS attack in the web management interface of Cisco Expressway Series [3].
The vulnerability is present in product:
- *:Cisco Expressway Series; <=14.0; >=15.0, <15.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X
More information:
- CVE-2025-20179 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an authenticated remote attacker, by uploading a specially crafted XML file in Cisco AsyncOS software for Cisco Secure Email Gateway and Cisco Secure Web Appliance, to execute arbitrary commands with root privileges in the operating system of the affected device [4].
The vulnerability is present in products:
- *:Secure Email Gateway; <=15.0; >=15.5, <16.0.0-050; >=16.0, <16.0.0-050
- *:Secure Web Appliance; <=15.1; >=15.2, <15.2.2-009
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2025-20184 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an unauthenticated remote attacker, by sending a specially crafted HTTP request in Cisco AsyncOS software for Cisco Secure Web Appliance, to bypass the antivirus scanner and download a malicious file to the endpoint. The vulnerability exists on systems with the Range Request Forward feature enabled; whether a configuration is vulnerable, and information on mitigation, can be found at [5].
The vulnerability is present in product:
- *:Cisco Secure Web Appliance; <=14.0; >=14.5, <15.0.1-004; >=15.0, <15.0.1-004; >=15.1, <15.2.1-011; >=15.2, <15.2.1-011
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N/E:X/RL:X/RC:X
More information:
- CVE-2025-20183 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an authenticated remote attacker with valid administrator credentials, through insufficient validation of user input in the Cisco ISE web interface, to perform a stored XSS attack [6].
The vulnerability is present in product:
- *:Cisco Identity Services Engine; >=3.0, <3.2P8; >=3.1, <3.2P8; >=3.2, <3.2P8; >=3.3, <3.3P4; >=3.4, <3.4P1
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X
More information:
- CVE-2025-20204 at cve.org, NVD
- CVE-2025-20205 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an authenticated remote attacker, through insufficient validation of user input in the web interface of Cisco AsyncOS for Secure Email and Web Manager and Secure Email Gateway, to perform a stored XSS attack. To exploit it, the attacker must have valid credentials with at least the Operator role [7].
The vulnerability is present in products:
- *:Secure Email and Web Manager; <=15.0; >=15.5, <15.5.3-017; >=16.0, <16.0.1-010
- *:Secure Email Gateway; <=15.0; >=15.5.0, <15.5.3-022; >=16.0, <16.0.1-017
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X
More information:
- CVE-2025-20180 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an authenticated remote attacker, through a specially crafted SNMP request, to obtain confidential information about the underlying operating system on Cisco Secure Email and Web Manager, Cisco Secure Email Gateway and Cisco Secure Web Appliance devices. The vulnerability affects only instances with the SNMP protocol enabled, which you can check according to the procedure in [8].
The vulnerability is present in products:
- *:Secure Email and Web Manager; <15.5.2-005;>=16.0,<16.0.0-195
- *:Secure Email Gateway; <15.0.3-002; >=15.5, <15.5.2-018; >=16.0, <16.0.0-050
- *:Secure Web Appliance; <15.0.1-004; >=15.1, <15.2.1-010; >=15.2, <15.2.1-010
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
More information:
- CVE-2025-20207 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXF
- [2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-dos-sdxnSUcW
- [3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-xss-uexUZrEW
- [4] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-multi-yKUJhS34
- [5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swa-range-bypass-2BsEHYSu
- [6] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-42tgsdMG
- [7] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-xss-WCk2WcuG
- [8] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-snmp-inf-FqPvL8sX
By CESNET, z.s.p.o. Michaela Jarošová on 10. 2. 2025.