Attacks pummeling Cisco AsyncOS 0-day since late November

"Suspected Chinese-government-linked threat actors have been battering a maximum-severity Cisco AsyncOS zero-day vulnerability in some Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances for nearly a month, and there's no timeline for a fix. Cisco disclosed the bug, tracked as CVE-2025-20393, on Wednesday and said it affects both physical and virtual SEG and SEWM appliances in certain non-standard configurations where the Spam Quarantine feature is enabled and exposed to the internet."

""On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet ... This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance," according to the security advisory. The vendor also published recommendations for customers to assess exposure and mitigate risks. According to Cisco's threat intel arm Talos, the attacks have been ongoing "since at least late November 2025.""

"A Cisco spokesperson declined to answer The Register's questions, including how many appliances have been infected and when it will release a fix. "We strongly urge customers to follow guidance in the advisory to assess any exposure and mitigate risk," the spokesperson said. "Cisco is actively investigating the issue and developing a permanent remediation." Also on Wednesday, the US Cybersecurity and Infrastructure Security Agency added CVE-2025-20393 to its Known Exploited Vulnerabilities (KEV) catalog."

Cisco AsyncOS contains a maximum-severity zero-day (CVE-2025-20393) affecting certain physical and virtual Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances configured with Spam Quarantine exposed to the internet. Exploitation allows arbitrary command execution with root privileges on affected appliances. Attacks began in late November 2025 and have continued for nearly a month, during which operators deploy a Python-based backdoor (AquaShell), reverse tunnels (AquaTunnel, chisel) and persistent access tools. Cisco recommends assessing exposure and mitigations and is developing a permanent remediation. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.

Read at Theregister