CVE-2024-20401
published 2024-07-17CVE-2024-20401: A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.28%
81.1th percentile
A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device.
Note: Manual intervention is required to recover from the DoS condition. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_secure_email | — | — |
| cisco | secure_email_gateway | < 15.5.1-055 | 15.5.1-055 |
| cisco | secure_email_gateway | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit is delivered via email with a crafted attachment; monitor for emails with malicious attachments traversing the SEG when file analysis or content filters are enabled on incoming mail policies. ↗
- →The root cause is an absolute path traversal (CWE-36) in attachment handling; detect path traversal sequences (e.g., absolute paths) within email attachment filenames or metadata processed by Cisco AsyncOS. ↗
- →Vulnerable condition requires Content Scanner Tools version earlier than 23.3.0.4823; audit installed Content Scanner Tools version on all SEG appliances as a triage step. ↗
- →Vulnerable condition also requires file analysis (Cisco AMP) or content filter feature enabled and assigned to an incoming mail policy; check 'Mail Policies > Incoming Mail Policies > Advanced Malware Protection > Mail Policy' for 'Enable File Analysis' checkbox. ↗
- →Post-exploitation indicator: unexpected new OS-level users with root privileges on the SEG appliance may indicate successful exploitation. ↗
- →A permanently unresponsive/crashed SEG appliance requiring manual TAC recovery may be an indicator of a successful DoS exploitation of this vulnerability. ↗
- ·Vulnerability is only exploitable when BOTH conditions are met: (1) file analysis (Cisco AMP) OR content filter feature is enabled and assigned to an incoming mail policy, AND (2) Content Scanner Tools version is earlier than 23.3.0.4823. ↗
- ·The fix is delivered via Content Scanner Tools package version 23.3.0.4823 and later, included by default in Cisco AsyncOS for Cisco Secure Email Software releases 15.5.1-055 and later; no workaround exists. ↗
- ·No public proof-of-concept exploit code or in-the-wild exploitation had been observed at time of advisory publication. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
vendor_cisco·2024-07-17·CVSS 9.8
CVE-2024-20401 [CRITICAL] CWE-36 Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denia
Cisco
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
vendor_cisco·CVSS 3.1
CVE-2024-20401 Cisco Secure Email Gateway Arbitrary File Write Vulnerability
CVE-2024-20401: Cisco Secure Email Gateway Arbitrary File Write Vulnerability
A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a p
GHSA
GHSA-4rcj-fmjg-q9fv: A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker t
ghsa_unreviewed·2024-07-17
CVE-2024-20401 [CRITICAL] CWE-36 GHSA-4rcj-fmjg-q9fv: A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker t
A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device.
Note: Man
No detection rules found.
No public exploits indexed.
Bleepingcomputer
New Cisco DoS flaw requires manual reboot to revive devices
blogs_bleepingcomputer·2026-05-06·CVSS 9.9
CVE-2026-20188 [CRITICAL] New Cisco DoS flaw requires manual reboot to revive devices
## New Cisco DoS flaw requires manual reboot to revive devices
## Sergiu Gatlan
Cisco released security updates to fix a Crosswork Network Controller (CNC) and Network Services Orchestrator (NSO) denial-of-service (DoS) vulnerability that requires manually rebooting targeted systems for recovery.
Large enterprises and service providers leverage the CNC software suite to simplify multivendor network management and operations handling with automation, while the NSO orchestration platform helps them manage network devices and resources.
Tracked as CVE-2026-20188 , this high-severity security flaw stems from inadequate rate limiting on incoming network connections and can be exploited remotely by unauthenticated threat actors to crash unpatched Cisco CNC and Cisco NSO systems through low-c
Bleepingcomputer
Cisco fixes root escalation vulnerability with public exploit code
blogs_bleepingcomputer·2024-09-04·CVSS 8.8
CVE-2024-20469 [HIGH] Cisco fixes root escalation vulnerability with public exploit code
## Cisco fixes root escalation vulnerability with public exploit code
## Sergiu Gatlan
Cisco has fixed a command injection vulnerability with public exploit code that lets attackers escalate privileges to root on vulnerable systems.
Tracked as CVE-2024-20469 , the security flaw was found in Cisco's Identity Services Engine (ISE) solution, an identity-based network access control and policy enforcement software that enables network device administration and endpoint access control in enterprise environments.
This OS command injection vulnerability is caused by insufficient validation of user-supplied input. Local attackers can exploit this weakness by submitting maliciously crafted CLI commands in low-complexity attacks that don't require user interaction.
However, as Cisco explains, t
Bleepingcomputer
Critical Cisco bug lets hackers add root users on SEG devices
blogs_bleepingcomputer·2024-07-18·CVSS 9.8
CVE-2024-20401 [CRITICAL] Critical Cisco bug lets hackers add root users on SEG devices
## Critical Cisco bug lets hackers add root users on SEG devices
## Sergiu Gatlan
Cisco has fixed a critical severity vulnerability that lets attackers add new users with root privileges and permanently crash Security Email Gateway (SEG) appliances using emails with malicious attachments.
Tracked as CVE-2024-20401, this arbitrary file write security flaw in the SEG content scanning and message filtering features is caused by an absolute path traversal weakness that allows replacing any file on the underlying operating system.
"This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. A successful exploit could allow the attacker to replace any file on the underlying file system," Cisco explained .
"The attacker could then p
2024-07-17
Published