CriticalCVE-2025-20393

    Cisco Multiple Products Improper Input Validation Vulnerability (CVE-2025-20393)

    Published In CISA KEV since Sources: CVE.org, CERT-EU

    What is affected, what to do

    A buffer overflow vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the affected device. This vulnerability arises from insufficient validation of HTTP requests and is actively exploited in ransomware campaigns since December 2025. Affected versions range from 15.0.2-007 to 16.0.4-016 of Cisco AsyncOS. An immediate update to the latest version is urgently recommended to mitigate this risk.

    The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Cisco Secure Email eq 14.0.0-698..14.0.0-698
    • Cisco Secure Email eq 13.5.1-277..13.5.1-277
    • Cisco Secure Email eq 13.0.0-392..13.0.0-392
    • Cisco Secure Email eq 14.2.0-620..14.2.0-620
    • Cisco Secure Email eq 13.0.5-007..13.0.5-007
    • Cisco Secure Email eq 13.5.4-038..13.5.4-038
    • Cisco Secure Email eq 14.2.1-020..14.2.1-020
    • Cisco Secure Email eq 14.3.0-032..14.3.0-032
    • Cisco Secure Email eq 15.0.0-104..15.0.0-104
    • Cisco Secure Email eq 15.0.1-030..15.0.1-030
    • Cisco Secure Email eq 15.5.0-048..15.5.0-048
    • Cisco Secure Email eq 15.5.1-055..15.5.1-055
    • Cisco Secure Email eq 15.5.2-018..15.5.2-018
    • Cisco Secure Email eq 16.0.0-050..16.0.0-050
    • Cisco Secure Email eq 15.0.3-002..15.0.3-002
    • Cisco Secure Email eq 16.0.0-054..16.0.0-054
    • Cisco Secure Email eq 15.5.3-022..15.5.3-022
    • Cisco Secure Email eq 16.0.1-017..16.0.1-017
    • Cisco Secure Email and Web Manager eq 13.6.2-023..13.6.2-023
    • Cisco Secure Email and Web Manager eq 13.6.2-078..13.6.2-078
    • Cisco Secure Email and Web Manager eq 13.0.0-249..13.0.0-249
    • Cisco Secure Email and Web Manager eq 13.0.0-277..13.0.0-277
    • Cisco Secure Email and Web Manager eq 13.8.1-052..13.8.1-052
    • Cisco Secure Email and Web Manager eq 13.8.1-068..13.8.1-068
    • Cisco Secure Email and Web Manager eq 13.8.1-074..13.8.1-074
    • Cisco Secure Email and Web Manager eq 14.0.0-404..14.0.0-404
    • Cisco Secure Email and Web Manager eq 12.8.1-002..12.8.1-002
    • Cisco Secure Email and Web Manager eq 14.1.0-227..14.1.0-227
    • Cisco Secure Email and Web Manager eq 13.6.1-201..13.6.1-201
    • Cisco Secure Email and Web Manager eq 14.2.0-203..14.2.0-203
    • Cisco Secure Email and Web Manager eq 14.2.0-212..14.2.0-212
    • Cisco Secure Email and Web Manager eq 12.8.1-021..12.8.1-021
    • Cisco Secure Email and Web Manager eq 13.8.1-108..13.8.1-108
    • Cisco Secure Email and Web Manager eq 14.2.0-224..14.2.0-224
    • Cisco Secure Email and Web Manager eq 14.3.0-120..14.3.0-120
    • Cisco Secure Email and Web Manager eq 15.0.0-334..15.0.0-334
    • Cisco Secure Email and Web Manager eq 15.5.1-024..15.5.1-024
    • Cisco Secure Email and Web Manager eq 15.5.1-029..15.5.1-029
    • Cisco Secure Email and Web Manager eq 15.5.2-005..15.5.2-005
    • Cisco Secure Email and Web Manager eq 16.0.0-195..16.0.0-195
    • Cisco Secure Email and Web Manager eq 15.5.3-017..15.5.3-017
    • Cisco Secure Email and Web Manager eq 16.0.1-010..16.0.1-010
    • Cisco Secure Email and Web Manager eq 15.0.1-035..15.0.1-035
    • Cisco Secure Email and Web Manager eq 16.0.2-088..16.0.2-088

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    10.0

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    10.0

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: CVE.org, CERT-EU

    32.4 %

    EPSS score

    Elevated — model estimates 10-50% exploitation likelihood.

    Source: FIRST EPSS, percentile 98.3

    Show all metrics
    Severity
    Critical
    Priority score

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    240.36
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited (KEV)Source: VulnCheck KEV (opens in a new tab)
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    10.0
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    10.0
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    32.4 %
    Elevated — model estimates 10-50% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    98.3
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-20

    Response and mitigation

    Why act now?

    Prioritisation rationale

    CVE-2025-20393 carries a CVSS v3 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — the maximum possible — and sits at the 98.1st EPSS percentile, indicating an exceptionally high probability of active exploitation attempts in the near term. The vulnerability requires no authentication, no user interaction, and no special network position, and grants full root-level code execution with a scope change that extends beyond the vulnerable component itself. For NIS2-scoped organisations operating Cisco Secure Email Gateway or Secure Email and Web Manager as critical communication infrastructure, a successful exploit means complete compromise of the email security gateway, potential exfiltration of all processed mail, and a viable pivot point into the internal network. Although CISA has not set the known-ransomware-campaign flag, the EPSS score and CVSS profile justify treating this as a P1 incident and patching ahead of any scheduled maintenance window.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Apply the vendor patch immediately: Cisco has released fixes for CVE-2025-20393. Affected AsyncOS versions include 15.0.x (fixed in 15.0.5-016 / 15.0.2-007 lines), 15.5.x (fixed from 15.5.4-012), and 16.0.x (fixed from 16.0.4-016). Confirm the exact target version in the Cisco Security Advisory and deploy to all Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances without delay.
      • Block external access to the Spam Quarantine web interface: Restrict HTTP/HTTPS access to the Spam Quarantine ports (default TCP 82 for HTTP, TCP 83 for HTTPS) at the perimeter firewall to internal management networks only — no direct internet exposure.
      • Isolate appliances that cannot be patched within 2 hours: Place unpatched appliances behind a dedicated WAF or reverse proxy that filters HTTP requests to the Spam Quarantine interface, or remove them from production network access entirely until the patch is applied.
      • Audit running processes and root-level activity: On each affected appliance, run ps aux and last immediately; document any unknown processes running as root or unexpected login events and escalate as a security incident.
      • Review access logs for signs of exploitation: Inspect AsyncOS Spam Quarantine access logs for the past 30 days, focusing on anomalous POST requests with long or encoded parameters targeting /esa or /sma endpoints.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: Restrict Spam Quarantine management ports (TCP 82, 83) to the internal administrator VLAN only. Apply ACL rules on the upstream router or firewall: deny ip any [Appliance-IP] eq 82 and deny ip any [Appliance-IP] eq 83 for all sources outside the management segment.
      • WAF / reverse proxy: Route all inbound HTTP traffic destined for the Spam Quarantine interface through a reverse proxy configured to block anomalous request bodies — oversized headers, unexpected HTTP methods, Base64- or URL-encoded payloads in query strings. Request and activate a Cisco IPS/Snort signature for CVE-2025-20393 from the vendor.
      • Disable anonymous Spam Quarantine access: Ensure end-user quarantine access requires authentication (LDAP or SAML); disable anonymous access in AsyncOS under System Administration > Spam Quarantine > External Spam Quarantine.
      • Block unexpected outbound connections from appliances: Appliances should not initiate outbound connections to arbitrary external IPs. Enforce egress firewall rules that permit only known update and telemetry destinations; alert on any other outbound TCP sessions originating from appliance IPs.
      • Integrity baseline check: Use the AsyncOS supportrequest command to capture the current configuration and installed package state; compare against a known-good snapshot to detect persistence mechanisms such as backdoors or modified cron jobs.

    3. Runbook step 3

      Detection rules

      • AsyncOS access log — anomalous HTTP requests: Search the Spam Quarantine access log for POST requests returning HTTP 200 to /esa or /sma endpoints with query strings exceeding 512 characters or containing shell metacharacters (%3B, %7C, %60, ;, |). 
        SPL: index=cisco_asyncos sourcetype=cisco:esa:accesslog method=POST (uri="/esa*" OR uri="/sma*") | where len(uri)>512 OR match(uri, "(%3B|%7C|%60|;|\|)")
      • Syslog / auditd — root process spawned by web process: If syslog forwarding is enabled, alert on processes with UID 0 whose parent is a web server process such as httpd or python. 
        KQL: event.dataset:"cisco.asyncos" AND process.parent.name:("httpd" OR "python*") AND user.id:"0"
      • Network telemetry (Zeek / Suricata): Monitor Zeek HTTP logs for connections to TCP 82/83 on appliance IPs originating from source IPs outside the management network; alert on uri_length > 512 or POST requests with response MIME types other than text/html.
      • Firewall flow logs — reverse shell indicators: Correlate outbound connections from appliance IPs to uncommon destination ports (e.g. TCP 4444, 1337, 8080) targeting external addresses. Sigma shape: 
        title: Cisco AsyncOS Outbound Shell
logsource: category: firewall
detection: src_ip: [Appliance-IP-Range] dst_port|contains: ['4444','1337'] condition: selection
      • SIEM correlation — authentication bypass indicator: Flag HTTP 200 responses to authenticated Spam Quarantine endpoints where no prior authentication event is recorded in the session — a direct successful response to a protected endpoint without a login sequence is a strong exploitation indicator.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

    Source: NVD (NIST), certeu_advisory, cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    VendorProductAffected versionsFixed in
    CiscoCisco Secure Email
    • 13.0.0-392
    • 13.0.5-007
    • 13.5.1-277
    • 13.5.4-038
    • 14.0.0-698
    • 14.2.0-620
    • 14.2.1-020
    • 14.3.0-032
    • 15.0.0-104
    • 15.0.1-030
    • 15.0.3-002
    • 15.5.0-048
    • 15.5.1-055
    • 15.5.2-018
    • 15.5.3-022
    • 16.0.0-050
    • 16.0.0-054
    • 16.0.1-017
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    CiscoCisco Secure Email and Web Manager
    • 12.8.1-002
    • 12.8.1-021
    • 13.0.0-249
    • 13.0.0-277
    • 13.6.1-201
    • 13.6.2-023
    • 13.6.2-078
    • 13.8.1-052
    • 13.8.1-068
    • 13.8.1-074
    • 13.8.1-108
    • 14.0.0-404
    • 14.1.0-227
    • 14.2.0-203
    • 14.2.0-212
    • 14.2.0-224
    • 14.3.0-120
    • 15.0.0-334
    • 15.0.1-035
    • 15.5.1-024
    • 15.5.1-029
    • 15.5.2-005
    • 15.5.3-017
    • 16.0.0-195
    • 16.0.1-010
    • 16.0.2-088
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —

    Affected operating systems

    Affected operating systems
    FamilyVendorProductVersion
    Otherciscoasyncos—

    Weakness classes (CWE)

    • CWE-20Improper Input Validation

      Class

      The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

      Entry at MITRE CWE-20

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    SourceReferenceMaturityPublished
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited (KEV)

    References & sources

    • sec.cloudapps.cisco.comcisco-sa-sma-attack-N9bf4Vendor advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393government-resource, US government resource

    Linked advisories