← Back to browse · API

CVE-2025-20393

Severity
CRITICAL
CVSS
10.0
EPSS
0.2951
Risk score
75.33
CISA KEV
Yes
PoC
No
Published
2025-12-17
Modified
2026-02-26
First seen
2026-08-07
Aliases
EUVD-2025-203911, GHSA-MRGJ-CG36-FGQ8
Products
Cisco:Cisco Secure Email 13.0.0-392, Cisco:Cisco Secure Email 13.0.5-007, Cisco:Cisco Secure Email 13.5.1-277, Cisco:Cisco Secure Email 13.5.4-038, Cisco:Cisco Secure Email 14.0.0-698, Cisco:Cisco Secure Email 14.2.0-620, Cisco:Cisco Secure Email 14.2.1-020, Cisco:Cisco Secure Email 14.3.0-032, Cisco:Cisco Secure Email 15.0.0-104, Cisco:Cisco Secure Email 15.0.1-030, Cisco:Cisco Secure Email 15.0.3-002, Cisco:Cisco Secure Email 15.5.0-048, Cisco:Cisco Secure Email 15.5.1-055, Cisco:Cisco Secure Email 15.5.2-018, Cisco:Cisco Secure Email 15.5.3-022, Cisco:Cisco Secure Email 16.0.0-050, Cisco:Cisco Secure Email 16.0.0-054, Cisco:Cisco Secure Email 16.0.1-017, Cisco:Cisco Secure Email and Web Manager 12.8.1-002, Cisco:Cisco Secure Email and Web Manager 12.8.1-021, Cisco:Cisco Secure Email and Web Manager 13.0.0-249, Cisco:Cisco Secure Email and Web Manager 13.0.0-277, Cisco:Cisco Secure Email and Web Manager 13.6.1-201, Cisco:Cisco Secure Email and Web Manager 13.6.2-023, Cisco:Cisco Secure Email and Web Manager 13.6.2-078, Cisco:Cisco Secure Email and Web Manager 13.8.1-052, Cisco:Cisco Secure Email and Web Manager 13.8.1-068, Cisco:Cisco Secure Email and Web Manager 13.8.1-074, Cisco:Cisco Secure Email and Web Manager 13.8.1-108, Cisco:Cisco Secure Email and Web Manager 14.0.0-404, Cisco:Cisco Secure Email and Web Manager 14.1.0-227, Cisco:Cisco Secure Email and Web Manager 14.2.0-203, Cisco:Cisco Secure Email and Web Manager 14.2.0-212, Cisco:Cisco Secure Email and Web Manager 14.2.0-224, Cisco:Cisco Secure Email and Web Manager 14.3.0-120, Cisco:Cisco Secure Email and Web Manager 15.0.0-334, Cisco:Cisco Secure Email and Web Manager 15.0.1-035, Cisco:Cisco Secure Email and Web Manager 15.5.1-024, Cisco:Cisco Secure Email and Web Manager 15.5.1-029, Cisco:Cisco Secure Email and Web Manager 15.5.2-005, Cisco:Cisco Secure Email and Web Manager 15.5.3-017, Cisco:Cisco Secure Email and Web Manager 16.0.0-195, Cisco:Cisco Secure Email and Web Manager 16.0.1-010, Cisco:Cisco Secure Email and Web Manager 16.0.2-088, Cisco:Multiple Products
Sources
euvd EUVD-2025-203911
cisa.gov CVE-2025-20393

Description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

References