PT-2025-5710 · Cisco · Cisco Asyncos

Published 2025-02-05 · Updated 2025-08-06 · CVE-2025-20185

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance (affected versions not specified)

Description: A vulnerability in the implementation of the remote access functionality could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. This issue is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this by generating a temporary password for the service account, potentially allowing the execution of arbitrary commands as root and access to the underlying operating system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2025-20185

Affected Products

Cisco Asyncos

References · 6

• https://osv.dev/vulnerability/CVE-2025-20185 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-multi-yKUJhS34 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20185 · Security Note
• https://t.me/cveNotify/131107 · Telegram Post
• https://twitter.com/CVEnew/status/1887179220989649138 · Twitter Post
• https://t.me/cvedetector/17303 · Telegram Post