Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Privilege Escalation Vulnerability
Priority LOW 29CWE-250Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-250.
Summary
A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. This vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this vulnerability by generating a temporary password for the service account. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system. Note: The Security Impact Rating (SIR) for this vulnerability is Medium due to the unrestricted scope of information that is accessible to an attacker.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00187 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Secure Email | 14.0.0-698; 13.5.1-277; 13.0.0-392; 14.2.0-620; 13.0.5-007; 13.5.4-038; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055; 15.5.2-018; 15.0.3-002 | — | No fix listed | CNA |
| Cisco | Cisco Secure Email and Web Manager | 13.6.2-023; 13.6.2-078; 13.0.0-249; 13.0.0-277; 13.8.1-052; 13.8.1-068; 13.8.1-074; 14.0.0-404; 12.8.1-002; 14.1.0-227; 13.6.1-201; 14.2.0-203; 14.2.0-212; 12.8.1-021; 13.8.1-108; 14.2.0-224; 14.3.0-120; 15.0.0-334; 15.5.1-024; 15.5.1-029; 15.5.2-005 | — | No fix listed | CNA |
| Cisco | Cisco Secure Web Appliance | 11.8.0-453; 12.5.3-002; 12.0.3-007; 12.0.3-005; 14.1.0-032; 14.1.0-047; 14.1.0-041; 12.0.4-002; 14.0.2-012; 11.8.0-414; 12.0.1-268; 11.8.1-023; 11.8.3-021; 11.8.3-018; 12.5.1-011; 11.8.4-004; 12.5.2-007; 12.5.2-011; 14.5.0-498; 12.5.4-005; 12.5.4-011; 12.0.5-011; 14.0.3-014; 12.5.5-004; 12.5.5-005; 12.5.5-008; 14.0.4-005; 14.5.1-008; 14.5.1-016; 15.0.0-355; 15.0.0-322; 12.5.6-008; 15.1.0-287; 14.5.2-011; 15.2.0-116; 14.0.5-007; 15.2.0-164; 14.5.1-510; 12.0.2-012; 12.0.2-004; 14.5.1-607; 14.5.3-033; 15.0.1-004; 15.2.1-011; 14.5.0-673; 14.5.0-537; 12.0.1-334; 14.0.1-503; 14.0.1-053; 11.8.0-429; 14.0.1-040; 14.0.1-014; 12.5.1-043 | — | No fix listed | CNA |
- Cisco Secure Email VendorCisco Affected 14.0.0-698; 13.5.1-277; 13.0.0-392; 14.2.0-620; 13.0.5-007; 13.5.4-038; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055; 15.5.2-018; 15.0.3-002 Fixed in — No fix listed CNA
- Cisco Secure Email and Web Manager VendorCisco Affected 13.6.2-023; 13.6.2-078; 13.0.0-249; 13.0.0-277; 13.8.1-052; 13.8.1-068; 13.8.1-074; 14.0.0-404; 12.8.1-002; 14.1.0-227; 13.6.1-201; 14.2.0-203; 14.2.0-212; 12.8.1-021; 13.8.1-108; 14.2.0-224; 14.3.0-120; 15.0.0-334; 15.5.1-024; 15.5.1-029; 15.5.2-005 Fixed in — No fix listed CNA
- Cisco Secure Web Appliance VendorCisco Affected 11.8.0-453; 12.5.3-002; 12.0.3-007; 12.0.3-005; 14.1.0-032; 14.1.0-047; 14.1.0-041; 12.0.4-002; 14.0.2-012; 11.8.0-414; 12.0.1-268; 11.8.1-023; 11.8.3-021; 11.8.3-018; 12.5.1-011; 11.8.4-004; 12.5.2-007; 12.5.2-011; 14.5.0-498; 12.5.4-005; 12.5.4-011; 12.0.5-011; 14.0.3-014; 12.5.5-004; 12.5.5-005; 12.5.5-008; 14.0.4-005; 14.5.1-008; 14.5.1-016; 15.0.0-355; 15.0.0-322; 12.5.6-008; 15.1.0-287; 14.5.2-011; 15.2.0-116; 14.0.5-007; 15.2.0-164; 14.5.1-510; 12.0.2-012; 12.0.2-004; 14.5.1-607; 14.5.3-033; 15.0.1-004; 15.2.1-011; 14.5.0-673; 14.5.0-537; 12.0.1-334; 14.0.1-503; 14.0.1-053; 11.8.0-429; 14.0.1-040; 14.0.1-014; 12.5.1-043 Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:asyncos:13.0.0-392:*:*:*:*:*:*:* | 13.0.0-392 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:13.0.5-007:*:*:*:*:*:*:* | 13.0.5-007 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:13.5.1-277:*:*:*:*:*:*:* | 13.5.1-277 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:13.5.4-038:*:*:*:*:*:*:* | 13.5.4-038 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:14.0.0-698:*:*:*:*:*:*:* | 14.0.0-698 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:14.2.0-620:*:*:*:*:*:*:* | 14.2.0-620 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:14.2.1-020:*:*:*:*:*:*:* | 14.2.1-020 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:14.3.0-032:*:*:*:*:*:*:* | 14.3.0-032 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:15.0.0-104:*:*:*:*:*:*:* | 15.0.0-104 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:15.0.1-030:*:*:*:*:*:*:* | 15.0.1-030 | Vulnerable | Cisco |
- cpe:2.3:o:cisco:asyncos:13.0.0-392:*:*:*:*:*:*:* Versions 13.0.0-392 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:13.0.5-007:*:*:*:*:*:*:* Versions 13.0.5-007 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:13.5.1-277:*:*:*:*:*:*:* Versions 13.5.1-277 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:13.5.4-038:*:*:*:*:*:*:* Versions 13.5.4-038 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:14.0.0-698:*:*:*:*:*:*:* Versions 14.0.0-698 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:14.2.0-620:*:*:*:*:*:*:* Versions 14.2.0-620 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:14.2.1-020:*:*:*:*:*:*:* Versions 14.2.1-020 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:14.3.0-032:*:*:*:*:*:*:* Versions 14.3.0-032 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:15.0.0-104:*:*:*:*:*:*:* Versions 15.0.0-104 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:15.0.1-030:*:*:*:*:*:*:* Versions 15.0.1-030 Vulnerable ·Cisco
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:asyncos:15.0.3-002:*:*:*:*:*:*:* | 15.0.3-002 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:15.5.0-048:*:*:*:*:*:*:* | 15.5.0-048 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:15.5.1-055:*:*:*:*:*:*:* | 15.5.1-055 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asyncos:15.5.2-018:*:*:*:*:*:*:* | 15.5.2-018 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m100v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m300v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m600v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m170:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m190:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m195:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m380:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m390x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m395:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m680:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m690:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m690x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:secure_email_and_web_manager_m695:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:asyncos:15.0.3-002:*:*:*:*:*:*:* Versions 15.0.3-002 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:15.5.0-048:*:*:*:*:*:*:* Versions 15.5.0-048 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:15.5.1-055:*:*:*:*:*:*:* Versions 15.5.1-055 Vulnerable ·Cisco
- cpe:2.3:o:cisco:asyncos:15.5.2-018:*:*:*:*:*:*:* Versions 15.5.2-018 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m100v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m300v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m600v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m170:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m190:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m195:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m380:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m390x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m680:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m690x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:secure_email_and_web_manager_m695:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-20185
- 2026-10-03 Alias added: GHSA-6wm7-ghvr-4m2g
References
Advisory 1
More Cisco Asyncos vulnerabilities
- TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
- TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2025-14683 Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2021-13698 Cisco Web Security Appliance Proxy Service Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2018-11020 Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2019-01567 Cisco Email Security Appliance Denial of Service Vulnerability CVSS 3.1HIGH 8.6
Sources
- CVE-2025-20185 · CVE Program
- CVE-2025-20185 · NVD
- FIRST EPSS
- GHSA-6wm7-ghvr-4m2g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences