CVE-2025-20393

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

At a glance

Severity: CRITICAL 10.0
Exploitation: Known exploited (CISA KEV) · added 2025-12-17
Exploited per ENISA since 2025-12-17
EPSS: EPSS 32.39 % · percentile 98 (2026-10-27)
State: PUBLISHED
Published: 2025-12-17
Updated: 2026-10-07
Assigner: cisco
NVD status: Analyzed

Description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	cisco
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	NVD · psirt@cisco.com (Secondary)

Weaknesses (CWE)

CWE-20

European references

ENISA EUVD · EUVD-2025-203911
GCVE · GCVE-0-2025-20393

CERT-FR advisories

CERTFR-2025-AVI-1120 — Vulnérabilité dans les produits Cisco · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* < 15.0.5-016
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* ≥ 15.5 < 15.5.4-012
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* ≥ 16.0 < 16.0.4-016
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* < 15.0.2-007
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* ≥ 15.5 < 15.5.4-007
cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* ≥ 16.0 < 16.0.4-010

Affected products

Product	Versions
Cisco · Cisco Secure Email	affected 14.0.0-698 ; affected 13.5.1-277 ; affected 13.0.0-392 ; affected 14.2.0-620 ; affected 13.0.5-007 ; affected 13.5.4-038
Cisco · Cisco Secure Email and Web Manager	affected 13.6.2-023 ; affected 13.6.2-078 ; affected 13.0.0-249 ; affected 13.0.0-277 ; affected 13.8.1-052 ; affected 13.8.1-068

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD