CVE-2025-20393

Published: Dec 17, 2025Modified: Jun 17, 2026CISA KEV

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: psirt@cisco.com (Secondary)

Description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Affected (6)

Products: Cisco: Asyncos

Cisco

1 product

Asyncos

Configuration A

3 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Cisco Asyncos	Before 15.0.5-016
Cisco Asyncos	From 15.5 to 15.5.4-012
Cisco Asyncos	From 16.0 to 16.0.4-016

Running on/with	Platform Versions
Cisco Secure Email Gateway C195	All versions
Cisco Secure Email Gateway C395	All versions
Cisco Secure Email Gateway C695	All versions
Cisco Secure Email Gateway Virtual Appliance C100v	All versions
Cisco Secure Email Gateway Virtual Appliance C300v	All versions
Cisco Secure Email Gateway Virtual Appliance C600v	All versions

Configuration B

3 vulnerable · 14 platform

Vulnerable Software	Affected Versions
Cisco Asyncos	Before 15.0.2-007
Cisco Asyncos	From 15.5 to 15.5.4-007
Cisco Asyncos	From 16.0 to 16.0.4-010

Running on/with	Platform Versions
Cisco Secure Email And Web Manager M170	All versions
Cisco Secure Email And Web Manager M190	All versions
Cisco Secure Email And Web Manager M195	All versions
Cisco Secure Email And Web Manager M380	All versions
Cisco Secure Email And Web Manager M390	All versions
Cisco Secure Email And Web Manager M390x	All versions
Cisco Secure Email And Web Manager M395	All versions
Cisco Secure Email And Web Manager M680	All versions
Cisco Secure Email And Web Manager M690	All versions
Cisco Secure Email And Web Manager M690x	All versions
Cisco Secure Email And Web Manager M695	All versions
Cisco Secure Email And Web Manager Virtual Appliance M100v	All versions
Cisco Secure Email And Web Manager Virtual Appliance M300v	All versions
Cisco Secure Email And Web Manager Virtual Appliance M600v	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4

Source: psirt@cisco.com

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.