7.2

CVE-2025-20184

Cisco Secure Email and Web Manager and Secure Web Appliance Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must authenticate with valid administrator credentials.

This vulnerability is due to insufficient validation of XML configuration files by an affected device. An attacker could exploit this vulnerability by uploading a crafted XML configuration file. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Asyncos Version 11.8.0-414
Cisco ≫ Asyncos Version 11.8.0-429
Cisco ≫ Asyncos Version 11.8.0-453
Cisco ≫ Asyncos Version 11.8.1-023
Cisco ≫ Asyncos Version 11.8.3-018
Cisco ≫ Asyncos Version 11.8.3-021
Cisco ≫ Asyncos Version 11.8.4-004
Cisco ≫ Asyncos Version 12.0.1-268
Cisco ≫ Asyncos Version 12.0.1-334
Cisco ≫ Asyncos Version 12.0.2-004
Cisco ≫ Asyncos Version 12.0.2-012
Cisco ≫ Asyncos Version 12.0.3-005
Cisco ≫ Asyncos Version 12.0.3-007
Cisco ≫ Asyncos Version 12.0.4-002
Cisco ≫ Asyncos Version 12.0.5-011
Cisco ≫ Asyncos Version 12.5.1-011
Cisco ≫ Asyncos Version 12.5.1-043
Cisco ≫ Asyncos Version 12.5.2-007
Cisco ≫ Asyncos Version 12.5.2-011
Cisco ≫ Asyncos Version 12.5.3-002
Cisco ≫ Asyncos Version 12.5.4-005
Cisco ≫ Asyncos Version 12.5.4-011
Cisco ≫ Asyncos Version 12.5.5-004
Cisco ≫ Asyncos Version 12.5.5-005
Cisco ≫ Asyncos Version 12.5.5-008
Cisco ≫ Asyncos Version 12.5.6-008
Cisco ≫ Asyncos Version 14.0.1-014
Cisco ≫ Asyncos Version 14.0.1-040
Cisco ≫ Asyncos Version 14.0.1-053
Cisco ≫ Asyncos Version 14.0.1-503
Cisco ≫ Asyncos Version 14.0.2-012
Cisco ≫ Asyncos Version 14.0.3-014
Cisco ≫ Asyncos Version 14.0.4-005
Cisco ≫ Asyncos Version 14.0.5-007
Cisco ≫ Asyncos Version 14.1.0-032
Cisco ≫ Asyncos Version 14.1.0-041
Cisco ≫ Asyncos Version 14.1.0-047
Cisco ≫ Asyncos Version 14.5.0-498
Cisco ≫ Asyncos Version 14.5.0-537
Cisco ≫ Asyncos Version 14.5.0-673
Cisco ≫ Asyncos Version 14.5.1-008
Cisco ≫ Asyncos Version 14.5.1-016
Cisco ≫ Asyncos Version 14.5.1-510
Cisco ≫ Asyncos Version 14.5.1-607
Cisco ≫ Asyncos Version 14.5.2-011
Cisco ≫ Asyncos Version 14.5.3-033
Cisco ≫ Asyncos Version 15.0.0-322
Cisco ≫ Asyncos Version 15.0.0-355
Cisco ≫ Asyncos Version 15.0.1-004
Cisco ≫ Asyncos Version 15.1.0-287
Cisco ≫ Asyncos Version 15.2.0-116
Cisco ≫ Asyncos Version 15.2.0-164
Cisco ≫ Asyncos Version 15.2.1-011
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.85% 0.536
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Cisco PSIRT 6.5 1.2 5.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-multi-yKUJhS34
Vendor Advisory