CVE-2023-20075: Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due…

PriorityP336medium6.7CVSS 3.1

AVLACLPRHUINSUCHIHAH

EPSS

0.36%

28.5th percentile

Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_secure_email	—	—
cisco	cisco_secure_email	—	—
cisco	cisco_secure_email	—	—
cisco	cisco_secure_email	—	—
cisco	cisco_secure_email	—	—
cisco	email_security_appliance	>= 12.5.0 < 12.5.3-041	12.5.3-041
cisco	email_security_appliance	>= 13.0.0 < 13.0.5-007	13.0.5-007
cisco	email_security_appliance	>= 13.5.0 < 13.5.4-038	13.5.4-038
cisco	email_security_appliance	>= 14.0.0 < 14.2.1-020	14.2.1-020
cisco	email_security_appliance	>= 14.3.0 < 14.3.0-032	14.3.0-032
cisco	email_security_appliance_and_cisco_secure_email_and_web_manager	—	—

CVSS provenance

nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vendor_cisco6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.