CVE-2025-20393

Name of the Vulnerable Software and Affected Versions Cisco Secure Email Gateway (affected versions not specified) Cisco Secure Email and Web Manager (affected versions not specified) Cisco AsyncOS Software (affected versions not specified)

Description Insufficient validation of HTTP requests in the Spam Quarantine feature allows an unauthenticated remote attacker to execute arbitrary system commands with root privileges on the underlying operating system. This issue is exploited when the Spam Quarantine feature is enabled and its interface is accessible from the internet.

Real-world exploitation has been linked to a China-nexus advanced persistent threat group known as UAT-9686. This actor deployed a Python-based backdoor named AquaShell to maintain persistence, along with other tools including AquaTunnel (for reverse SSH tunneling), Chisel (for tunneling), and AquaPurge (for clearing system logs). The AquaShell backdoor specifically responds to crafted, unauthenticated HTTP POST requests to execute commands directly in the system shell.

Recommendations Install the latest updates for AsyncOS Software to resolve the issue. Immediately block internet access to the Spam Quarantine interface (TCP ports 80, 443, and 83) using network firewalls. Restrict access to management and Spam Quarantine interfaces to trusted hosts only. Separate mail-handling functions from management interfaces to reduce risk. For devices confirmed to be compromised, perform a full system re-image and change all credentials, as updates alone cannot remove modified system partitions. Disable the Spam Quarantine feature if it is not essential for operations.