Read the docs
TI-2023-06718 Aliases CVE-2023-20009GHSA-rj99-fcj2-r7fw

Improper input validation in Cisco Secure Email

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]]. The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device.

Why it matters now

EPSS 0.02227 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Secure Email11.0.3-238; 11.1.0-069; 11.1.0-131; 11.1.0-128; 12.0.0-419; 12.1.0-071; 12.1.0-087; 12.1.0-089; 13.0.0-392; 13.5.1-277; 12.5.0-066; 14.0.0-698; 14.2.0-620—No fix listedCNA
CiscoCisco Secure Email and Web Manager11.0.0-115; 11.0.1-161; 11.5.1-105; 12.0.0-452; 12.0.1-011; 12.5.0-636; 12.5.0-658; 12.5.0-678; 12.5.0-670; 13.0.0-277; 13.6.2-078; 13.8.1-068; 13.8.1-074; 12.8.1-002; 14.0.0-404; 14.1.0-223; 14.1.0-227; 14.2.0-212—No fix listedCNA
  • Cisco Secure Email VendorCisco Affected 11.0.3-238; 11.1.0-069; 11.1.0-131; 11.1.0-128; 12.0.0-419; 12.1.0-071; 12.1.0-087; 12.1.0-089; 13.0.0-392; 13.5.1-277; 12.5.0-066; 14.0.0-698; 14.2.0-620 Fixed in — No fix listed CNA
  • Cisco Secure Email and Web Manager VendorCisco Affected 11.0.0-115; 11.0.1-161; 11.5.1-105; 12.0.0-452; 12.0.1-011; 12.5.0-636; 12.5.0-658; 12.5.0-678; 12.5.0-670; 13.0.0-277; 13.6.2-078; 13.8.1-068; 13.8.1-074; 12.8.1-002; 14.0.0-404; 14.1.0-223; 14.1.0-227; 14.2.0-212 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*before 12.5.3-041; 13.0.0 to before 13.0.5-007; 13.5.0 to before 13.5.4-038; 14.0.0 to before 14.2.1-020; 14.3.0 to before 14.3.0-032VulnerableCisco
cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*before 12.8.1-021; 13.8.0 to before 13.8.1-108; 14.0.0 to before 14.2.0-224; 14.3.0 to before 14.3.0-120VulnerableCisco
  • cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:* Versions before 12.5.3-041; 13.0.0 to before 13.0.5-007; 13.5.0 to before 13.5.4-038; 14.0.0 to before 14.2.1-020; 14.3.0 to before 14.3.0-032 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:* Versions before 12.8.1-021; 13.8.0 to before 13.8.1-108; 14.0.0 to before 14.2.0-224; 14.3.0 to before 14.3.0-120 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-20009
  2. 2026-10-03 Alias added: GHSA-rj99-fcj2-r7fw

References

Advisory 1

  • TI-2022-05357 Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-01567 Cisco Email Security Appliance Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2018-00378 Improper input validation in Cisco Email Security Appliance CVSS 3.0HIGH 7.5
  • TI-2020-02695 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-01541 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.0HIGH 7.5
  • TI-2019-01553 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.0HIGH 7.4
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences