CVE-2025-20393CISA KEV: Actively Exploited

Cisco Multiple Products Improper Input Validation Vulnerability

Published Dec 17, 2025Updated Dec 17, 2025

Description

Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.

Public Exploits & PoCs7 found

PoC: cisco-sa-sma-attack-N9bf4

Script to detect CVE-2025-20393 for Cisco Secure Email Gateway And Cisco Secure Email and Web Manager

3

PoC: CVE-2025-20393-POC

This scanner detects Cisco SEG/SEWM appliances vulnerable to CVE-2025-20393, a critical unauthenticated RCE vulnerability in Cisco AsyncOS affecting devices with Spam Quarantine feature exposed to the internet. CVSS Score: 10.0 (Critical)

1

PoC: CYBERDUDEBIVASH-Cisco-AsyncOS-CVE-2025-20393-Scanner

This tool helps identify exposure to CVE-2025-20393 by checking for open TCP/6025 ports, responsive Spam Quarantine interfaces, and known post-exploitation IOCs.

PoC: mrh701.github.io

馃攳 Probe hosts for open Cisco Secure Email/Malware Analytics ports and CVE-2025-20393 exposure using a simple Python script.

PoC: Blackash-CVE-2025-20393

CVE-2025-20393

PoC: Blackash-CVE-2025-20393

CVE-2025-20393

PoC: CVE-2025-20393

Cisco is aware of a potential vulnerability.  Cisco is currently investigating and will update these details as appropriate as more information becomes available.

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free