Cisco Secure Email Gateway Zero-Day Exploited in the Wild: Critical RCE Threat

Description

CVE-2025-20393 is a critical remote code execution vulnerability affecting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running vulnerable Cisco AsyncOS releases.

The vulnerability exists in the Spam Quarantine feature because of insufficient validation of HTTP requests. An unauthenticated attacker can send specially crafted HTTP requests to the vulnerable service and execute arbitrary commands with root-level privileges.

The vulnerability is particularly dangerous when Spam Quarantine is enabled and the affected interface is exposed to the internet. Cisco documentation indicates that the vulnerable configuration typically uses port 6025, and the feature is not enabled by default.

Technical Description

The vulnerability is tracked as:

The vulnerability allows an attacker to remotely interact with the vulnerable Spam Quarantine functionality without authentication. Successful exploitation can provide root-level command execution on the affected appliance, creating a direct path to compromise the email-security infrastructure.

Attack Overview

The observed attack chain can be summarized as:

Internet-exposed Cisco appliance → Crafted HTTP request → CVE-2025-20393 exploitation → Root-level command execution → AquaShell persistence → AquaTunnel/Chisel tunneling → Internal reconnaissance/pivoting → Log cleanup

Cisco reported that exploitation activity began at least as early as November 2025, while Cisco became aware of the attacks on December 10, 2025.

The campaign was attributed by Cisco Talos with moderate confidence to UAT-9686 / UNC-9686, a China-nexus threat actor. Tooling overlaps with activity associated with groups including APT41 and UNC5174 contributed to the assessment.

Exploitation and Post-Exploitation Activity

Following exploitation, attackers were observed deploying several tools.

AquaShell

AquaShell is a Python-based backdoor used by the attackers to maintain persistent remote access to compromised appliances.

AquaTunnel

AquaTunnel was used for reverse SSH tunneling, allowing the attackers to establish covert connectivity and facilitate access to internal environments.

Chisel

Chisel was also used for tunneling and internal pivoting, potentially allowing attackers to move traffic through compromised infrastructure.

AquaPurge

AquaPurge was used to remove or manipulate logs, helping attackers reduce evidence of their activity and complicate forensic investigations.

The observed activity indicates that exploitation was not limited to obtaining initial code execution. Attackers used the compromised appliances as platforms for persistent access, tunneling, internal movement, and defense evasion.

Targeting and Threat Actor

Cisco Talos attributes the campaign to UAT-9686, also tracked as UNC-9686, with moderate confidence.

The assessment is based in part on tooling and infrastructure overlaps with previously observed China-nexus activity involving groups such as APT41 and UNC5174.

Reported targets include:

• Telecommunications organizations
• Critical infrastructure
• Enterprise email environments

The observed post-exploitation activity was primarily focused on espionage rather than ransomware deployment.

CISA Known Exploited Vulnerabilities Status

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-20393 to its Known Exploited Vulnerabilities catalog on December 17, 2025.

Federal civilian agencies were required to mitigate the vulnerability by December 24, 2025.

Indicators of Compromise

The available source does not provide conventional IP addresses, domains, or file hashes for the campaign.

However, the following tool and behavioral indicators were identified:

UAT-9686
UNC-9686
AquaShell
AquaTunnel
Chisel
AquaPurge
TCP/6025

Cisco recommends organizations that suspect compromise work with Cisco Technical Assistance Center (TAC), with remote access enabled where required for investigation.

Potential Impact

Successful exploitation of CVE-2025-20393 could allow an unauthenticated remote attacker to obtain root-level control of an affected Cisco email-security appliance.

Potential consequences include:

• Complete compromise of the affected appliance
• Persistent unauthorized access
• Modification of system configurations
• Access to sensitive email-security infrastructure
• Internal network reconnaissance
• Network pivoting through tunneling
• Credential or configuration exposure
• Security-control bypass
• Log manipulation and forensic evidence destruction
• Espionage and information collection
• Potential compromise of connected enterprise infrastructure

Because the vulnerable appliance may sit at a strategic position within an organization's email-security architecture, compromise can provide attackers with a valuable foothold into the wider enterprise environment.

Recommendations

Immediate Actions

• Upgrade affected Cisco Secure Email Gateway appliances to a fixed release immediately.
• Upgrade Cisco Secure Email and Web Manager appliances to the appropriate fixed release.
• Verify whether Spam Quarantine is enabled.
• Determine whether TCP 6025 is reachable from the internet.
• Remove unnecessary internet exposure from affected management interfaces.
• Review system and authentication logs for suspicious activity.
• Hunt for AquaShell, AquaTunnel, Chisel, and AquaPurge.
• Investigate unexpected SSH tunnels and outbound connections.
• Review the appliance for unauthorized persistence mechanisms.
• Contact Cisco TAC if compromise is suspected.
• Consider rebuilding compromised appliances where required to completely remove attacker persistence.

Cisco states that there are no workarounds for the vulnerability and recommends upgrading to the fixed releases.

Preventive Actions

• Keep Cisco Secure Email Gateway and management appliances fully patched.
• Avoid exposing administrative and security-management interfaces directly to the internet.
• Separate mail-processing interfaces from management interfaces where possible.
• Disable unnecessary services such as HTTP and FTP.
• Apply strong authentication mechanisms such as SAML or LDAP.
• Monitor outbound connections originating from security appliances.
• Forward appliance logs to an external, protected logging platform.
• Monitor for unexpected SSH tunneling and proxy activity.
• Integrate appliance telemetry into SIEM and SOC monitoring workflows.
• Regularly review internet exposure of security infrastructure.
• Maintain tested configuration backups and incident-response procedures for security appliances.

Cisco Secure Email Cloud services are reported as unaffected.

Fixed Releases

Cisco Secure Email Gateway

Cisco Secure Email and Web Manager

Conclusion

CVE-2025-20393 represents a critical threat to organizations operating vulnerable Cisco Secure Email Gateway or Secure Email and Web Manager appliances. Its 10.0 CVSS score, unauthenticated remote exploitation, root-level command execution, and confirmed exploitation in the wild make immediate remediation essential.

The observed campaign demonstrates how compromising an internet-exposed security appliance can provide attackers with persistent access, tunneling capabilities, internal pivot opportunities, and the ability to conceal activity. Organizations should prioritize upgrading affected appliances, eliminate unnecessary internet exposure, and conduct retrospective threat hunting for the associated post-exploitation tooling.