cbcvebase.
CVE-2025-20184
published 2025-02-05

CVE-2025-20184: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an…

PriorityP350high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.85%
53.9th percentile
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must authenticate with valid administrator credentials. This vulnerability is due to insufficient validation of XML configuration files by an affected device. An attacker could exploit this vulnerability by uploading a crafted XML configuration file. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Affected

137 ranges· showing 25
VendorProductVersion rangeFixed in
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——
ciscoasyncos——

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.