Skip to content
Hermes Codex

CVE-2025-20393: Unauthenticated Root RCE in Cisco Secure Email Gateway (Spam Quarantine)

HERMES

HERMES THREAT SCORE & EMAIL SECURITY PERIMETER APPLIANCE

Target: Cisco AsyncOS on Secure Email Gateway (SEG) and Secure Email & Web Manager (SMA)
Confidence: 99%
98 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 19 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2025-20393 at an HTS of 98 (CRITICAL). Carrying a CVSS base score of 10.0, this flaw was actively exploited in zero-day campaigns by threat actor UAT-9686. The attacker gains root privileges on the underlying operating system and implants persistent backdoors inside enterprise mail infrastructure.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-20393: Unauthenticated Root RCE in Cisco Secure Email Gateway (Spam Quarantine)VULNERABILITY

Connected Nodes: 3
Active Relationships (Outgoing)
→ affectsPRODUCTCisco Secure Email Gateway (AsyncOS)
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Cisco Secure Email Gateway (AsyncOS) documented in Hermes dossier.”

Supporting Verified Evidence:
→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter
90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:
→ usesATTACK TECHNIQUET1566: Phishing / Untrusted Content Ingestion
90% VERY_HIGH

Adversaries send malicious files, pull requests, or links to gain initial execution or subvert automated analysis pipelines.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1566.”

Supporting Verified Evidence:

1. Identification

Section titled “1. Identification”
ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2025-20393Cisco Advisory cisco-sa-sma-attack-N9bf4
Associated CWECWE-20: Improper Input ValidationCommand injection via HTTP Quarantine endpoints
CVSS v3.1 Score10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Applicable CPEscpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_email_gateway:*:*:*:*:*:*:*:*		Secure Email Gateway (SEG) and SMA appliances
Affected VersionsAsyncOS 13.0, 13.5, 14.0, 14.2, 14.3, 15.0 (< 15.0.3-010)All devices with quarantine services reachable
Fixed VersionsAsyncOS 15.0.3-010 and emergency maintenance releasesVendor-provided software patches

2. Exploitation

Section titled “2. Exploitation”
  • CISA KEV: Added on December 17, 2025.
  • EPSS Score: 0.29875 (Percentile: 98.1%).
  • Threat Actor: UAT-9686 (Uncategorized Advanced Threat actor tracked by Cisco Talos).
  • Attack Mechanics: Unauthenticated HTTP requests sent to the Spam Quarantine feature pass unvalidated parameters into shell commands executed with root privileges.

3. Detection and Forensics

Section titled “3. Detection and Forensics”

Sigma Rule

Section titled “Sigma Rule”
title: Cisco SEG Spam Quarantine Injection Attempt (CVE-2025-20393)
id: 20393-cisco-seg-quarantine-rce-en
status: production
description: Detects command injection attempts against Cisco AsyncOS Spam Quarantine web interfaces.
logsource:
  category: webserver
  product: cisco_asyncos
detection:
  selection_url:
    cs-method: 'POST'
    cs-uri-stem|contains: '/quarantine/'
  selection_shell:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '`'
      - '$('
  condition: selection_url and selection_shell
level: critical

MITRE ATT&CK

Section titled “MITRE ATT&CK”
  • T1190: Exploit Public-Facing Application
  • T1059.004: Unix Shell
  • T1505: Server Software Component
  • T1566: Phishing Interception

4. Remediation and Hardening

Section titled “4. Remediation and Hardening”
  1. Deploy Software Updates: Apply the updated AsyncOS versions provided by Cisco immediately.
  2. Execute Compromise Assessment: Follow Cisco Talos indicators to verify that persistent root implants or rogue cron jobs were not established by UAT-9686.
  3. Restrict Quarantine Exposure: Limit external access to the quarantine web interface to authorized management subnets or secure VPNs.

5. Enterprise Exploitation Scenario

Section titled “5. Enterprise Exploitation Scenario”

« What happens if this vulnerability is exploited in an enterprise? »

Section titled “« What happens if this vulnerability is exploited in an enterprise? »”
  1. Infiltration of Core Mail Gateway: An advanced threat actor exploits the quarantine endpoint, securing unauthenticated root command execution on the Cisco Secure Email Gateway.
  2. Implantation of Covert Backdoor: The adversary modifies system files to establish persistent command-and-control access independent of future firmware reboots.
  3. Mail Traffic Interception: The actor accesses all inbound and outbound email correspondence, harvesting executive emails, altering financial wire instructions, and copying sensitive contracts.
  4. Perimeter Ghost Node: Because edge networking appliances rarely run standard EDR sensors, the attacker uses the compromised gateway as an undetectable covert jump host into internal corporate enclaves.

6. Related Intelligence & Attack Paths

Section titled “6. Related Intelligence & Attack Paths”
Cisco SEG AsyncOS SQLi to Root RCE (CVE-2026-76461) Analyze the critical zero-click zero-day flaw in email parsing logic actively exploited in 2026.
Cisco Secure Email Gateway Component Intelligence Access 30-day telemetry, version tracking, and vulnerability posture for Cisco SEG.