CVE-2025-20184

CWE-20 — Improper Input ValidationCWE-77 — Command InjectionCWE-2504 documents4 sources
Severity
7.2HIGH
EPSS
0.1%
top 76.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Cisco Secure EmailCisco Cisco Secure WEB ApplianceCisco Asyncos
Timeline
PublishedFeb 5

Description

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must authenticate with valid administrator credentials. This vulnerability is due to insufficient validation of XML configuration files by an affected device. An attacker could exploit this vulnerability by uploading a crafted XML co…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 1.2 | Impact: 5.2

Affected Packages3 packages

▶CVEListV5cisco/cisco_secure_email15 versions+14
▶CVEListV5cisco/cisco_secure_web_appliance53 versions+52
▶NVDcisco/asyncos68 versions+67

🔴Vulnerability Details

2
GHSA
GHSA-g9mx-x5c2-8c9j: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could al↗2025-02-05
▶
CVEList
Cisco Secure Email and Web Manager and Secure Web Appliance Command Injection Vulnerability↗2025-02-05
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Vulnerabilities↗2025-02-05
▶
CVE-2025-20184 (HIGH CVSS 7.2) | A vulnerability in the web-based ma | cvebase.io