Kevin BeaumontCisco have found an in the wild zero day in Cisco Secure Email Gateway And Cisco Secure Email and Web Manager being used to backdoor appliances for later access.
Now CVE-2025-20393.
No patch available.
They recommend nuking boxes and reinstalling from scratch if you opened spam quarantine port (6025 and 7025) to internet, and closing port.
It is unclear how long boxes have been backdoored for.
Ports aren't scanned by @shodan yet so scope isn't known.
Cisco Security Advisory: Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager
On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. The ongoing investigation has revealed evidence of a persistence mechanism planted by the threat actors to maintain a degree of control over compromised appliances. Cisco strongly recommends that customers follow the guidance provided in the Recommendations section of this advisory to assess exposure and mitigate risks. Cisco Talos discussed these attacks in the blog post UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4
Rob Ricci
Tris 🏳️⚧️👭😴
Mike Masnick
ceej
tweety fish
The A.V. Club
Computer Facts
Dare Obasanjo