On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. The ongoing investigation has revealed evidence of a persistence mechanism implanted by the threat actors to maintain a degree of control over compromised appliances. Cisco has remediated the vulnerability that was exploited by the threat actors as part of the cyberattack campaign. For more information about this vulnerability, see the Details ["#details"] section of this advisory. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco strongly recommends that customers follow the guidance provided in the Recommendations ["#Recommendations"]section of this advisory to assess exposure and mitigate risks. Cisco Talos wrote about these attacks in the blog post UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager ["https://blog.talosintelligence.com/uat-9686/"].

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Cisco is aware of a potential vulnerability.  Cisco is currently investigating and will update these details as appropriate as more information becomes available.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco AsyncOS und Cisco Secure Email Gateway ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.