Read the docs
TI-2023-06783 Aliases CVE-2023-20075GHSA-vwv2-hg2h-447m

Command injection in Cisco Secure Email

Priority LOW 31CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.

Why it matters now

EPSS 0.00877 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Secure Email13.0.0-392; 13.5.1-277; 12.5.0-066; 14.0.0-698; 14.2.0-620—No fix listedCNA
  • Cisco Secure Email VendorCisco Affected 13.0.0-392; 13.5.1-277; 12.5.0-066; 14.0.0-698; 14.2.0-620 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*12.5.0 to before 12.5.3-041; 13.0.0 to before 13.0.5-007; 13.5.0 to before 13.5.4-038; 14.0.0 to before 14.2.1-020; 14.3.0 to before 14.3.0-032VulnerableCisco
  • cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:* Versions 12.5.0 to before 12.5.3-041; 13.0.0 to before 13.0.5-007; 13.5.0 to before 13.5.4-038; 14.0.0 to before 14.2.1-020; 14.3.0 to before 14.3.0-032 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-20075
  2. 2026-10-03 Alias added: GHSA-vwv2-hg2h-447m
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2022-05357 Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-01567 Cisco Email Security Appliance Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2018-00378 Improper input validation in Cisco Email Security Appliance CVSS 3.0HIGH 7.5
  • TI-2020-02695 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-01541 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.0HIGH 7.5
  • TI-2019-01553 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.0HIGH 7.4
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences