Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-20185

A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. This vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this vulnerability by generating a temporary password for the service account. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system. Note: The Security Impact Rating (SIR) for this vulnerability is Medium due to the unrestricted scope of information that is accessible to an attacker.

Published

2025-02-05T17:15:25.883

Last Modified

2025-08-06T16:53:52.867

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 3.4 (LOW)

Weaknesses
  • Type: Primary
    CWE-250
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco asyncos 13.0.0-392 Yes
Operating System cisco asyncos 13.0.5-007 Yes
Operating System cisco asyncos 13.5.1-277 Yes
Operating System cisco asyncos 13.5.4-038 Yes
Operating System cisco asyncos 14.0.0-698 Yes
Operating System cisco asyncos 14.2.0-620 Yes
Operating System cisco asyncos 14.2.1-020 Yes
Operating System cisco asyncos 14.3.0-032 Yes
Operating System cisco asyncos 15.0.0-104 Yes
Operating System cisco asyncos 15.0.1-030 Yes
Operating System cisco asyncos 15.0.3-002 Yes
Operating System cisco asyncos 15.5.0-048 Yes
Operating System cisco asyncos 15.5.1-055 Yes
Operating System cisco asyncos 15.5.2-018 Yes
Application cisco secure_email_and_web_manager_virtual_appliance_m100v - No
Application cisco secure_email_and_web_manager_virtual_appliance_m300v - No
Application cisco secure_email_and_web_manager_virtual_appliance_m600v - No
Hardware cisco secure_email_and_web_manager_m170 - No
Hardware cisco secure_email_and_web_manager_m190 - No
Hardware cisco secure_email_and_web_manager_m195 - No
Hardware cisco secure_email_and_web_manager_m380 - No
Hardware cisco secure_email_and_web_manager_m390 - No
Hardware cisco secure_email_and_web_manager_m390x - No
Hardware cisco secure_email_and_web_manager_m395 - No
Hardware cisco secure_email_and_web_manager_m680 - No
Hardware cisco secure_email_and_web_manager_m690 - No
Hardware cisco secure_email_and_web_manager_m690x - No
Hardware cisco secure_email_and_web_manager_m695 - No
References