Cyber Posture

CVE-2025-20393

CriticalCISA KEVActive Exploitation

Published: 17 December 2025

Published
17 December 2025
Modified
16 January 2026
KEV Added
17 December 2025
Patch
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0513 89.9th percentile
Risk Priority 43 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20393 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Cisco Asyncos. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely flaw remediation through vendor patches directly eliminates the input validation vulnerability enabling root command execution.

prevent

Mandates validation of HTTP request inputs to the Spam Quarantine feature, directly addressing the improper input validation (CWE-20) root cause.

prevent

Boundary protection at external interfaces filters crafted HTTP requests to the vulnerable Spam Quarantine feature before they reach the flawed validation logic.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability allows unauthenticated remote attackers to execute arbitrary root commands via crafted HTTP requests to the public-facing Spam Quarantine feature, directly enabling T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root…

more

privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Deeper analysisAI

CVE-2025-20393 is a critical vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. It stems from insufficient validation of HTTP requests (CWE-20: Improper Input Validation), enabling an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and was published on 2025-12-17.

An unauthenticated, remote attacker can exploit this vulnerability by sending a crafted HTTP request to the affected device. Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root privileges, potentially leading to full compromise of the device.

The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4 provides details on mitigation and available patches. Additionally, the vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393, indicating active exploitation in the wild.

Details

CWE(s)
KEV Date Added
17 December 2025

Affected Products

cisco
asyncos
≤ 15.0.5-016 · 15.5 — 15.5.4-012 · 16.0 — 16.0.4-016

CVEs Like This One

CVE-2025-20337Same vendor: Ciscoboth on KEV
CVE-2026-20127Same vendor: Ciscoboth on KEV
CVE-2026-20131Same vendor: Ciscoboth on KEV
CVE-2026-6973Shared CWE-20both on KEV
CVE-2025-20352Same vendor: Ciscoboth on KEV
CVE-2026-20128Same vendor: Ciscoboth on KEV
CVE-2025-20142Same vendor: Cisco
CVE-2025-20333Same vendor: Ciscoboth on KEV
CVE-2025-20184Same product: Cisco Asyncos
CVE-2026-32201Shared CWE-20both on KEV

References