{"id":"CVE-2025-20393","published":"2025-12-17T17:15:48Z","modified":"2026-06-17T08:41:39Z","title":"Cisco Multiple Products Improper Input Validation Vulnerability","vendor":"Cisco","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper input validation weakness in the Spam Quarantine feature of Cisco AsyncOS Software, which runs on Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. An unauthenticated attacker with network access to the device can send a crafted HTTP request to execute arbitrary system commands with root privileges, requiring no credentials and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:59Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.32392,"percentile":0.98328,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-12-17","dueDate":"2025-12-24","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to Cisco's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Cisco products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4 ; https://nvd.nist.gov/vuln/detail/CVE-2025-20393","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-12-17","exploitedFirstSeen":"2025-12-17","ransomware":false,"evidence":[{"url":"https://blog.talosintelligence.com/uat-9686/","date":"2025-12-17"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4","date":"2025-12-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-12-17"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/6307","date":"2025-12-18"},{"url":"https://arcticwolf.com/resources/blog/cve-2025-20393/","date":"2025-12-19"},{"url":"https://censys.com/advisory/cve-2025-20393","date":"2025-12-19"},{"url":"https://www.linkedin.com/pulse/cisco-secure-email-gateway-under-siege-cve-2025-20393-cvss-10-bzyfc/","date":"2025-12-19"},{"url":"https://x.com/Shadowserver/status/2002446754159997002","date":"2025-12-20"},{"url":"https://hs-45734016.f.hubspotemail.net/hubfs/45734016/Global%20Threat%20Report%2c%20End%20of%202025.pdf","date":"2025-12-30"},{"url":"https://www.recordedfuture.com/blog/december-2025-cve-landscape","date":"2026-01-13"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploit of public-facing Spam Quarantine HTTP interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an unauthenticated, remote attacker to execute arbitrary system commands","start":143,"end":227}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary OS command execution as root","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary commands on the underlying operating system with","start":529,"end":595}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-203911","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203911","exploited":true,"exploitedSince":"2025-12-17","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":1,"earliest":"2025-12-18","earliestUrl":"https://github.com/cyberleelawat/CVE-2025-20393","repos":[{"name":"StasonJatham/cisco-sa-sma-attack-N9bf4","url":"https://github.com/StasonJatham/cisco-sa-sma-attack-N9bf4","stars":22,"created":"2025-12-18"},{"name":"cyberleelawat/CVE-2025-20393","url":"https://github.com/cyberleelawat/CVE-2025-20393","stars":2,"created":"2025-12-18"},{"name":"redpack-kr/Blackash-CVE-2025-20393","url":"https://github.com/redpack-kr/Blackash-CVE-2025-20393","stars":0,"created":"2025-12-28"},{"name":"cyberdudebivash/CYBERDUDEBIVASH-Cisco-AsyncOS-CVE-2025-20393-Scanner","url":"https://github.com/cyberdudebivash/CYBERDUDEBIVASH-Cisco-AsyncOS-CVE-2025-20393-Scanner","stars":0,"created":"2026-01-16"}]},"first":{"date":"2025-12-18","source":"PoC-in-GitHub","url":"https://github.com/cyberleelawat/CVE-2025-20393"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-12-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20393","provenance":"source"},{"date":"2025-12-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/uat-9686/","provenance":"source"},{"date":"2025-12-17","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-12-17","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203911","provenance":"source"},{"date":"2025-12-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/cyberleelawat/CVE-2025-20393","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":74.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 318 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.67,"detail":"percentile 0.9833"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}