CVE-2025-20184 [Medium] | Input Validation Bypass in Asyncos

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must authenticate with valid administrator credentials. This vulnerability is due to insufficient validation of XML configuration files by an affected device. An attacker could exploit this vulnerability by uploading a crafted XML configuration file. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-03-16	0.19%	0.07%	-0.13%
2	2025-11-21	0.33%	0.19%	-0.13%
3	2025-11-18	—	0.33%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-03-16

0.19%

0.07%

-0.13%

2025-11-21

0.33%

0.19%

-0.13%

2025-11-18

—

0.33%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.5	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:N) Service keeps running; no real outage angle.	1.2	5.2	[email protected]
7.2	3.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.2	5.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.5

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N): Service keeps running; no real outage angle.

1.2

5.2

[email protected]

7.2

3.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.2

5.9

[email protected]

Affected software / configurations for CVE-2025-20184

Vendor	Product	Version	Raw CPE
cisco	asyncos	13.0.0-392	cpe:2.3:o:cisco:asyncos:13.0.0-392:::::::*
cisco	asyncos	13.0.5-007	cpe:2.3:o:cisco:asyncos:13.0.5-007:::::::*
cisco	asyncos	13.5.1-277	cpe:2.3:o:cisco:asyncos:13.5.1-277:::::::*
cisco	asyncos	13.5.4-038	cpe:2.3:o:cisco:asyncos:13.5.4-038:::::::*
cisco	asyncos	14.0.0-698	cpe:2.3:o:cisco:asyncos:14.0.0-698:::::::*
cisco	asyncos	14.2.0-620	cpe:2.3:o:cisco:asyncos:14.2.0-620:::::::*
cisco	asyncos	14.2.1-020	cpe:2.3:o:cisco:asyncos:14.2.1-020:::::::*
cisco	asyncos	14.3.0-032	cpe:2.3:o:cisco:asyncos:14.3.0-032:::::::*
cisco	asyncos	15.0.0-104	cpe:2.3:o:cisco:asyncos:15.0.0-104:::::::*
cisco	asyncos	15.0.1-030	cpe:2.3:o:cisco:asyncos:15.0.1-030:::::::*
cisco	asyncos	15.0.3-002	cpe:2.3:o:cisco:asyncos:15.0.3-002:::::::*
cisco	asyncos	15.5.0-048	cpe:2.3:o:cisco:asyncos:15.5.0-048:::::::*
cisco	asyncos	15.5.1-055	cpe:2.3:o:cisco:asyncos:15.5.1-055:::::::*
cisco	asyncos	15.5.2-018	cpe:2.3:o:cisco:asyncos:15.5.2-018:::::::*
cisco	asyncos	15.5.3-022	cpe:2.3:o:cisco:asyncos:15.5.3-022:::::::*
cisco	asyncos	11.8.0-414	cpe:2.3:o:cisco:asyncos:11.8.0-414:::::::*
cisco	asyncos	11.8.0-429	cpe:2.3:o:cisco:asyncos:11.8.0-429:::::::*
cisco	asyncos	11.8.0-453	cpe:2.3:o:cisco:asyncos:11.8.0-453:::::::*
cisco	asyncos	11.8.1-023	cpe:2.3:o:cisco:asyncos:11.8.1-023:::::::*
cisco	asyncos	11.8.3-018	cpe:2.3:o:cisco:asyncos:11.8.3-018:::::::*
cisco	asyncos	11.8.3-021	cpe:2.3:o:cisco:asyncos:11.8.3-021:::::::*
cisco	asyncos	11.8.4-004	cpe:2.3:o:cisco:asyncos:11.8.4-004:::::::*
cisco	asyncos	12.0.1-268	cpe:2.3:o:cisco:asyncos:12.0.1-268:::::::*
cisco	asyncos	12.0.1-334	cpe:2.3:o:cisco:asyncos:12.0.1-334:::::::*
cisco	asyncos	12.0.2-004	cpe:2.3:o:cisco:asyncos:12.0.2-004:::::::*
cisco	asyncos	12.0.2-012	cpe:2.3:o:cisco:asyncos:12.0.2-012:::::::*
cisco	asyncos	12.0.3-005	cpe:2.3:o:cisco:asyncos:12.0.3-005:::::::*
cisco	asyncos	12.0.3-007	cpe:2.3:o:cisco:asyncos:12.0.3-007:::::::*
cisco	asyncos	12.0.4-002	cpe:2.3:o:cisco:asyncos:12.0.4-002:::::::*
cisco	asyncos	12.0.5-011	cpe:2.3:o:cisco:asyncos:12.0.5-011:::::::*
cisco	asyncos	12.5.1-011	cpe:2.3:o:cisco:asyncos:12.5.1-011:::::::*
cisco	asyncos	12.5.1-043	cpe:2.3:o:cisco:asyncos:12.5.1-043:::::::*
cisco	asyncos	12.5.2-007	cpe:2.3:o:cisco:asyncos:12.5.2-007:::::::*
cisco	asyncos	12.5.2-011	cpe:2.3:o:cisco:asyncos:12.5.2-011:::::::*
cisco	asyncos	12.5.3-002	cpe:2.3:o:cisco:asyncos:12.5.3-002:::::::*
cisco	asyncos	12.5.4-005	cpe:2.3:o:cisco:asyncos:12.5.4-005:::::::*
cisco	asyncos	12.5.4-011	cpe:2.3:o:cisco:asyncos:12.5.4-011:::::::*
cisco	asyncos	12.5.5-004	cpe:2.3:o:cisco:asyncos:12.5.5-004:::::::*
cisco	asyncos	12.5.5-005	cpe:2.3:o:cisco:asyncos:12.5.5-005:::::::*
cisco	asyncos	12.5.5-008	cpe:2.3:o:cisco:asyncos:12.5.5-008:::::::*
cisco	asyncos	12.5.6-008	cpe:2.3:o:cisco:asyncos:12.5.6-008:::::::*
cisco	asyncos	14.0.1-014	cpe:2.3:o:cisco:asyncos:14.0.1-014:::::::*
cisco	asyncos	14.0.1-040	cpe:2.3:o:cisco:asyncos:14.0.1-040:::::::*
cisco	asyncos	14.0.1-053	cpe:2.3:o:cisco:asyncos:14.0.1-053:::::::*
cisco	asyncos	14.0.1-503	cpe:2.3:o:cisco:asyncos:14.0.1-503:::::::*
cisco	asyncos	14.0.2-012	cpe:2.3:o:cisco:asyncos:14.0.2-012:::::::*
cisco	asyncos	14.0.3-014	cpe:2.3:o:cisco:asyncos:14.0.3-014:::::::*
cisco	asyncos	14.0.4-005	cpe:2.3:o:cisco:asyncos:14.0.4-005:::::::*
cisco	asyncos	14.0.5-007	cpe:2.3:o:cisco:asyncos:14.0.5-007:::::::*
cisco	asyncos	14.1.0-032	cpe:2.3:o:cisco:asyncos:14.1.0-032:::::::*
cisco	asyncos	14.1.0-041	cpe:2.3:o:cisco:asyncos:14.1.0-041:::::::*
cisco	asyncos	14.1.0-047	cpe:2.3:o:cisco:asyncos:14.1.0-047:::::::*
cisco	asyncos	14.5.0-498	cpe:2.3:o:cisco:asyncos:14.5.0-498:::::::*
cisco	asyncos	14.5.0-537	cpe:2.3:o:cisco:asyncos:14.5.0-537:::::::*
cisco	asyncos	14.5.0-673	cpe:2.3:o:cisco:asyncos:14.5.0-673:::::::*
cisco	asyncos	14.5.1-008	cpe:2.3:o:cisco:asyncos:14.5.1-008:::::::*
cisco	asyncos	14.5.1-016	cpe:2.3:o:cisco:asyncos:14.5.1-016:::::::*
cisco	asyncos	14.5.1-510	cpe:2.3:o:cisco:asyncos:14.5.1-510:::::::*
cisco	asyncos	14.5.1-607	cpe:2.3:o:cisco:asyncos:14.5.1-607:::::::*
cisco	asyncos	14.5.2-011	cpe:2.3:o:cisco:asyncos:14.5.2-011:::::::*
cisco	asyncos	14.5.3-033	cpe:2.3:o:cisco:asyncos:14.5.3-033:::::::*
cisco	asyncos	15.0.0-322	cpe:2.3:o:cisco:asyncos:15.0.0-322:::::::*
cisco	asyncos	15.0.0-355	cpe:2.3:o:cisco:asyncos:15.0.0-355:::::::*
cisco	asyncos	15.0.1-004	cpe:2.3:o:cisco:asyncos:15.0.1-004:::::::*
cisco	asyncos	15.1.0-287	cpe:2.3:o:cisco:asyncos:15.1.0-287:::::::*
cisco	asyncos	15.2.0-116	cpe:2.3:o:cisco:asyncos:15.2.0-116:::::::*
cisco	asyncos	15.2.0-164	cpe:2.3:o:cisco:asyncos:15.2.0-164:::::::*
cisco	asyncos	15.2.1-011	cpe:2.3:o:cisco:asyncos:15.2.1-011:::::::*

References for CVE-2025-20184

URL	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-multi-yKUJhS34	Vendor Advisory

URL

CVE-2025-20184 | Cisco Secure Email and Web Manager and Secure Web Appliance Command Injection Vulnerability

Exploit prediction scoring system (EPSS) score for CVE-2025-20184

Common vulnerability scoring system (CVSS) metrics for CVE-2025-20184

Weakness enumeration for CVE-2025-20184

Affected software / configurations for CVE-2025-20184

References for CVE-2025-20184