CVE-2025-20153
Cisco ESA mail Bypass
At a glance Severity MEDIUM 5.8 EPSS EPSS 0.36 % · percentile 30 (2026-10-27) State PUBLISHED Published 2025-02-19 Updated 2025-02-19 Assigner cisco NVD status Analyzed Description A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules and allow emails that should have been denied to flow through an affected device.
This vulnerability is due to improper handling of email that passes through an affected device. An attacker could exploit this vulnerability by sending a crafted email through the affected device. A successful exploit could allow the attacker to bypass email filters on the affected device.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N cisco CVSS 3.1 MEDIUM 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N NVD · psirt@cisco.com (Secondary) CVSS 3.1 MEDIUM 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
Affected configurations (NVD CPE) cpe:2.3:a:cisco:secure_email_gateway:13.0.0-392:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:13.0.5-007:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:13.5.1-277:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:13.5.4-038:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:14.0.0-698:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:14.2.0-620:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:14.2.1-020:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:14.3.0-032:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:15.0.0-104:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:15.0.1-030:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:15.0.3-002:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:15.5.0-048:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:15.5.1-055:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:15.5.2-018:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_email_gateway:16.0.0-050:*:*:*:*:*:*:*Affected products Product Versions Cisco · Cisco Secure Email affected 14.0.0-698 ; affected 13.5.1-277 ; affected 13.0.0-392 ; affected 14.2.0-620 ; affected 13.0.5-007 ; affected 13.5.4-038
References
Sources
