Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways

"The vulnerability, tracked as CVE-2025-20393 (CVSS score: 10.0), is a remote command execution flaw arising as a result of insufficient validation of HTTP requests by the Spam Quarantine feature. Successful exploitation of the defect could permit an attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. However, for the attack to work, three conditions must be met - The appliance is running a vulnerable release of Cisco AsyncOS Software The appliance is configured with the Spam Quarantine feature The Spam Quarantine feature is exposed to and reachable from the internet"

"Last month, the networking equipment major revealed that it found evidence of UAT-9686 exploiting the vulnerability as early as late November 2025 to drop tunneling tools like ReverseSSH (aka AquaTunnel) and Chisel, and a log cleaning utility called AquaPurge. The attacks are also characterized by the deployment of a lightweight Python backdoor dubbed AquaShell that's capable of receiving encoded commands and executing them."

"The vulnerability has now been addressed in the following versions, in addition to removing the persistence mechanisms that were identified in this attack campaign and installed on the appliances - Cisco Email Security Gateway Cisco AsyncOS Software Release 14.2 and earlier (Fixed in 15.0.5-016) Cisco AsyncOS Software Release 15.0 (Fixed in 15.0.5-016) Cisco AsyncOS Software Release 15.5 (Fixed in 15.5.4-012) Cisco AsyncOS Software Release 16.0 (Fixed in 16.0.4-016) Secure Email and Web Manager Cisco AsyncOS Software Release 15.0 and earlier (Fixed in 15.0.2"

Cisco released security updates for a maximum-severity remote command execution vulnerability, CVE-2025-20393, in Cisco AsyncOS for Secure Email Gateway and Secure Email and Web Manager. The flaw stems from insufficient validation of HTTP requests by the Spam Quarantine feature and can allow arbitrary commands to execute with root privileges on affected appliances. Exploitation requires a vulnerable AsyncOS release, an enabled Spam Quarantine feature, and internet exposure of that feature. Evidence shows China-nexus APT UAT-9686 exploited the defect as early as late November 2025 to deploy tunneling tools (ReverseSSH/AquaTunnel, Chisel), a log cleaner (AquaPurge), and a Python backdoor (AquaShell). Cisco issued fixes across multiple AsyncOS releases and removed identified persistence mechanisms.

Read at The Hacker News