This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco warns of a critical vulnerability in AsyncOS
Cisco warns of a critical vulnerability in the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager products (AsyncOS Software) [1][2][3]. Attackers are already actively exploiting this flaw. No fix is available yet, so the company recommends temporarily mitigating the risk according to the recommendations at [4].
An unauthenticated remote attacker can execute arbitrary commands with root privileges on the operating system of the affected device [1][3]. The device is vulnerable if the Spam Quarantine feature is configured and accessible from the internet, which is not the case by default. More detailed information on the vulnerable configuration and temporary risk mitigation can be found at [1]. Cisco notes that in the case of confirmed compromise, a complete reinstallation of the device is necessary.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-20393 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 17. 12. 2025.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4
- [2] https://thehackernews.com/2025/12/cisco-warns-of-active-attacks.html
- [3] https://blog.talosintelligence.com/uat-9686/
- [4] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4#Recommendations
By CESNET, z.s.p.o. Michaela Ručková on 18. 12. 2025.