CVE-2025-20185 — Execution with Unnecessary Privileges in Cisco Secure Email

CWE-250 — Execution with Unnecessary Privileges CWE-20 — Improper Input Validation4 documents4 sources

Severity

6.7MEDIUMNVD

CNA3.4

EPSS

0.0%

top 93.39%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Secure Email Cisco Secure Email AND WEB Manager Cisco Secure WEB Appliance +1 more

Timeline

PublishedFeb 5

Description

A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. This vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5cisco/cisco_secure_email_and_web_manager21 versions+20

▶CVEListV5cisco/cisco_secure_email14 versions+13

▶CVEListV5cisco/cisco_secure_web_appliance53 versions+52

▶NVDcisco/asyncos14 versions+13

🔴Vulnerability Details

GHSA

GHSA-6wm7-ghvr-4m2g: A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secur↗2025-02-05

▶

CVEList

Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Privilege Escalation Vulnerability↗2025-02-05

▶

📋Vendor Advisories

Cisco

Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Vulnerabilities↗2025-02-05

▶