Cyber Posture

CVE-2025-20184

MediumRCE

Published: 05 February 2025

Published
05 February 2025
Modified
08 August 2025
KEV Added
Patch
CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0008 23.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20184 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Cisco Asyncos. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the insufficient validation of XML configuration files that enables command injection by requiring input validation mechanisms at the web management interface.

prevent

Addresses the underlying flaw in Cisco AsyncOS Software by requiring timely identification, reporting, and correction of vulnerabilities like this command injection issue.

prevent

Limits the ability of authenticated administrators to upload crafted XML configuration files by enforcing strict access restrictions on system changes.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Direct command injection in public web management interface enables T1190; resulting root OS command execution maps to Unix Shell interpreter usage.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must authenticate…

more

with valid administrator credentials. This vulnerability is due to insufficient validation of XML configuration files by an affected device. An attacker could exploit this vulnerability by uploading a crafted XML configuration file. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Deeper analysisAI

CVE-2025-20184 is a command injection vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance. The issue stems from insufficient validation of XML configuration files, which allows an authenticated, remote attacker with valid administrator credentials to upload a crafted XML file and execute arbitrary commands on the underlying operating system with root privileges. It is rated with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) and is associated with CWE-20 (Improper Input Validation) and CWE-77 (Command Injection).

An attacker must first obtain valid administrator credentials to access the web management interface remotely over the network. Once authenticated, they can exploit the vulnerability by uploading a specially crafted XML configuration file, leading to command injection on the device. Successful exploitation grants root-level execution on the operating system, enabling high-impact confidentiality and integrity violations, such as data exfiltration or system modification, though availability is not directly affected.

The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-multi-yKUJhS34 provides details on affected versions, patch availability, and recommended mitigations for this vulnerability. Security practitioners should consult the advisory for precise upgrade paths and workarounds to address the issue.

Details

CWE(s)

Affected Products

cisco
asyncos
11.8.0-414, 11.8.0-429, 11.8.0-453, 11.8.1-023, 11.8.3-018

CVEs Like This One

CVE-2025-20393Same product: Cisco Asyncos
CVE-2025-20349Same vendor: Cisco
CVE-2025-20265Same vendor: Cisco
CVE-2026-20045Same vendor: Cisco
CVE-2025-20142Same vendor: Cisco
CVE-2025-20124Same vendor: Cisco
CVE-2026-20098Same vendor: Cisco
CVE-2025-20146Same vendor: Cisco
CVE-2026-20127Same vendor: Cisco
CVE-2025-20337Same vendor: Cisco

References