TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

CIS Advisories

A Vulnerability in Cisco AsyncOS Could Allow for Remote Code Execution

2025-12-18 · Read original ↗

ATT&CK techniques detected

6 predictions
T1190Exploit Public-Facing Application
94%
“kev ) catalog. systems affected : - all releases of cisco asyncos software are affected when both of the following conditions are met : - - the appliance is configured with the spam quarantine feature. - - the spam quarantine feature is exposed to and reachable from the internet.…”
T1078.001Default Accounts
94%
“2 : perform periodic external penetration tests : perform periodic external penetration tests based on program requirements, no less than annually. external penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. penetration…”
T1190Exploit Public-Facing Application
67%
“commands with root privileges on the underlying operating system of an affected appliance. the ongoing investigation has revealed evidence of a persistence mechanism planted by the threat actors to maintain a degree of control over compromised appliances. ( cve - 2025 - 20393 ) -…”
T1190Exploit Public-Facing Application
64%
“a vulnerability in cisco asyncos could allow for remote code execution a vulnerability in cisco asyncos could allow for remote code execution ms - isac advisory number : 2025 - 117date ( s ) issued : 12 / 18 / 2025overview : a vulnerability has been discovered in cisco asyncos, w…”
T1190Exploit Public-Facing Application
40%
“. o safeguard 7. 7 : remediate detected vulnerabilities : remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process. o safeguard 12. 1 : ensure network infrastructure is up - to - date : en…”
T1525Implant Internal Image
32%
“inventory of service accounts. the inventory, at a minimum, must contain department owner, review date, and purpose. perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently. * vulnerab…”

Summary

A vulnerability has been discovered in Cisco AsyncOS, which could allow for remote code execution. AsyncOS is the operating system used by Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands with root-level privileges on the underlying operating system.