CVE-2025-20393
CRITICAL KEVCisco AsyncOS < 15.0.5-016 - Unauthenticated Remote Code Execution via Spam Quarantine HTTP Request
Title source: llmExploitation Summary
CVE-2025-20393 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 17, 2025. EIP tracks 5 public exploits from researchers including StasonJatham, cyberleelawat, cyberdudebivash.
AI-analyzed exploit summary This repository contains a Python-based scanner for detecting exposure indicators of CVE-2025-20393 in Cisco Secure Email/Secure Malware Analytics systems. It checks for open management and quarantine ports, performs HTTP/S fingerprinting, and probes common spam quarantine paths.
Description
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
Exploits (5)
This repository contains a Python-based scanner for detecting exposure indicators of CVE-2025-20393 in Cisco Secure Email/Secure Malware Analytics systems. It checks for open management and quarantine ports, performs HTTP/S fingerprinting, and probes common spam quarantine paths.
This repository contains a scanner for detecting exposure of Cisco Secure Email Gateway (SEG) and Cisco Secure Email and Web Manager (SEWM) appliances affected by CVE-2025-20393. The scanner checks for the presence of the Spam Quarantine feature and confirms exposure by analyzing HTTP responses.
This repository contains a Python-based scanner for detecting indicators of CVE-2025-20393, an unauthenticated RCE vulnerability in Cisco Secure Email Gateway / SMA. It checks for open TCP/6025 ports, responsive Spam Quarantine interfaces, and local IOCs without performing exploitation.
This repository contains a Python-based scanner to detect potential exposure to CVE-2025-20393, a critical RCE vulnerability in Cisco AsyncOS. It checks for indicators of vulnerable Cisco Secure Email Gateway or Secure Email and Web Manager appliances by probing common paths and analyzing response content.
The repository lacks actual exploit code and instead provides generic detection methods (e.g., Nuclei scanner commands) and search dorks. The README is marketing-heavy with no technical details about the vulnerability's root cause or exploitation mechanics.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H