Cisco email security appliances rooted and backdoored via still unpatched zero-day
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-20393 | Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands CVE-2025-20393 is an improper input validation flaw (CWE-20) in Cisco Secure Email Gateway, Secure Email, AsyncOS software, and Web Manager appliances that lets attackers execute arbitrary commands with root privileges on the underlying operating system. The flaw is triggered when an affected appliance processes improperly validated input, though the CISA record does not specify the access vector or whether authentication is required. Successful exploitation yields full compromise of the appliance at the highest OS privilege level, which is significant because these devices sit in the email- and web-security path of enterprise networks. Organizations running these Cisco appliances are affected; CVSS has not yet been published and no public proof-of-concept is known. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2025-12-17, EPSS estimates a 29.9% chance of exploitation within 30 days (98th percentile), and ransomware use remains undetermined. Do: Apply the mitigations or updates Cisco specifies in its advisory for CVE-2025-20393 without waiting for a CVSS score; the CISA KEV entry directs users to vendor mitigations, applicable BOD 22-01 cloud-service guidance, or discontinuing use if mitigations are unavailable. Because this record contains no fixed-release details, check the Cisco PSIRT advisory for the exact patched AsyncOS and Web Manager versions before planning the upgrade. In the meantime, review appliance logs and configurations for signs of unexpected command execution or changes, since active exploitation is confirmed and ransomware use is still unknown. | 10.0 | 30% | KEV |
| largeroughly tens of thousands of appliance deployments worldwide (exact installed base unpublished) | |
| CVE-2025-5777 | Out-of-Bounds Read (Memory Overread) in Citrix NetScaler ADC and Gateway Citrix NetScaler ADC and NetScaler Gateway contain an out-of-bounds read (CWE-125) caused by insufficient input validation, which can cause the appliance to read beyond the intended memory buffer (a memory overread). The flaw is only triggerable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, so attackers who can reach those services can potentially induce the overread and obtain sensitive memory contents. Such disclosure could aid follow-on compromise, for example by exposing session or authentication data, and CISA notes known ransomware use. Organizations running NetScaler ADC or NetScaler Gateway in the affected Gateway/AAA configurations are exposed. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-10 with known ransomware use and an EPSS of 100% (100th percentile), indicating active exploitation, while no public PoC is known and a CVSS score has not yet been assigned. Do: Apply the fixed NetScaler ADC/Gateway builds per Citrix's security advisory (exact affected/fixed version ranges are not in the available data, so consult the bulletin); per CISA KEV, apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Inventory appliances for Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server configurations, since unconfigured/other deployments are not triggerable. After patching, terminate active and idle VPN sessions and hunt for anomalous access, given the known ransomware exploitation and the information-disclosure nature of the flaw. | 9.3 | 100% | KEV ransomware |
| massplausibly hundreds of thousands of installed/internet-exposed NetScaler ADC and Gateway appliances (public scans have historically shown on the order of… | |
| CVE-2025-7775 | Actively Exploited Memory Overflow RCE/DoS in Citrix NetScaler ADC/Gateway CVE-2025-7775 is a memory overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution and/or denial of service. It is triggered when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or AAA virtual server, or — on 13.1, 14.1, 13.1-FIPS, and NDcPP builds — when load-balancing virtual servers of type HTTP, SSL, or HTTP_QUIC are bound with IPv6 services or servicegroups with IPv6 servers (including DBS IPv6), or a CR virtual server of type HDX is in use. A remote, unauthenticated attacker (CVSS 4.0 network vector with no privileges required) who triggers the memory overflow can execute code with high impact on confidentiality and integrity or crash the device. Organizations running NetScaler in these exposed configurations, notably as remote-access gateways, are affected. Exploitation is confirmed in the wild: Citrix has confirmed active exploitation, the flaw was added to CISA's KEV catalog on 2025-08-26, and EPSS estimates a 19.6% probability of exploitation within 30 days (97th percentile). Do: Upgrade all NetScaler ADC and Gateway appliances to the patched builds on the 13.1, 14.1, 13.1-FIPS, and NDcPP release trains identified in Citrix's security bulletin, prioritizing internet-facing devices. Audit configurations for Gateway (VPN/ICA Proxy/CVPN/RDP Proxy) or AAA virtual servers, HTTP/SSL/HTTP_QUIC LB virtual servers with IPv6 bindings, and CR virtual servers of type HDX to confirm exposure. The KEV listing makes applying vendor mitigations or the upgrade mandatory for US federal agencies under BOD 22-01. | 9.2 | 20% | KEV |
| large≈28,000+ internet-exposed NetScaler instances per public scans; total vulnerable deployments likely higher |
Full article601 words · extracted from helpnetsecurity.com · click to collapse
A suspected Chinese-nexus threat group has been compromising Cisco email security devices and planting backdoors and log-purging tools on them since at least late November 2025, Cisco Talos researchers have shared.
“Our analysis indicates that appliances with non-standard configurations (…) are what we have observed as being compromised by the attack,” they noted.
According to the accompanying advisory, the attackers exploited CVE-2025-20393, an AsyncOS vulnerability stemming from improper input validation, to execute arbitrary commands with root privileges on the operating system of an affected appliance – and they didn’t have to authenticate to leverage the flaw.
This attack campaign targeted Cisco Secure Email Gateway (physical and virtual) and Cisco Secure Email and Web Manager (physical and virtual) appliances that were configured with the Spam Quarantine feature exposed to and reachable from the internet.
The attack tools
Cisco became aware of this activity on December 10, during the resolution of a Cisco Technical Assistance Center (TAC) support case.
Their subsequent investigation revealed that the attackers:
- Used the above mentioned CVE, currently without patch
- Achieved persistence on and a degree of control over the compromised appliances by installing:
- AquaShell, a custom-made Python backdoor
- AquaPurge, a tool that removes lines containing specific keywords from the log files
- AquaTunnel, a reverse SSH backdoor based on an open-source one
- Chisel, an open‑source tunneling tool used for proxying traffic
Cisco Talos researchers have shared IP addresses associated with the attack and hashes of some of the tools (though not of AquaShell).
What to do?
It is impossible to know, at this time, how many devices have been affected.
Cisco has noted that the Spam Quarantine feature is not enabled by default and that deployment guides for these products don’t require the associated port to be exposed to the internet.
The company continues to investigate the attack campaign and is likely to push out a fix for CVE-2025-20393 soon. In the meantime, they advise organizations using affected email security appliances to check whether they have enabled and configured the Spam Quarantine feature.
“If an appliance has been identified as having the web management interface or the Spam Quarantine port exposed to and reachable from the internet, Cisco strongly recommends following a multi-step process to restore the appliance to a secure configuration, when possible,” they urged.
If it’s not possible, they should contact Cisco TAC, which can check remotely whether they’ve been compromised.
“In case of confirmed compromise, rebuilding the appliances is, currently, the only viable option to eradicate the threat actors persistence mechanism from the appliance,” the company stated.
Who is behind the attacks?
“[We assess] with moderate confidence that this activity is being conducted by a Chinese-nexus threat actor, which we track as UAT-9686. We have observed overlaps in tactics, techniques and procedures (TTPs), infrastructure, and victimology between UAT-9686 and other Chinese-nexus threat actors Talos tracks,” Cisco’s analysts shared.
“Tooling used by UAT-9686, such as AquaTunnel (aka ReverseSSH), also aligns with previously disclosed Chinese-nexus APT groups such as APT41 and UNC5174. Additionally, the tactic of using a custom-made web-based implant such as AquaShell is increasingly being adopted by highly sophisticated Chinese-nexus APTs.”
According to security researcher Kevin Beaumont, the attack IP addresses shared by Cisco might point to a Chinese APT group that previously targeted Cisco ASA devices and equipped them with a persistent backdoor and custom malware to disable logging and preventing the creation of a crash dump, and breached Citrix NetScaler ADC appliances via CVE-2025-5777 and CVE-2025-7775.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/12/17/cisco-secure-email-cve-2025-20393/