CVE-2025-20393
CRITICAL KEVCisco AsyncOS - RCE
Title source: llmDescription
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
Exploits (5)
nomisec
SCANNER
22 stars
by StasonJatham · poc
https://github.com/StasonJatham/cisco-sa-sma-attack-N9bf4
nomisec
SCANNER
by cyberdudebivash · poc
https://github.com/cyberdudebivash/CYBERDUDEBIVASH-Cisco-AsyncOS-CVE-2025-20393-Scanner
Scores
CVSS v3
10.0
EPSS
0.0680
EPSS Percentile
91.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Details
CISA KEV
2025-12-17
VulnCheck KEV
2025-12-17
ENISA EUVD
EUVD-2025-203911
CWE
CWE-20
Status
published
Products (1)
cisco/asyncos
< 15.0.5-016
Published
Dec 17, 2025
KEV Added
Dec 17, 2025
Tracked Since
Feb 18, 2026