WID-SEC-W-2025-0276

Vulnerability from csaf_certbund - Published: 2025-02-05 23:00 - Updated: 2025-02-05 23:00
Summary
Cisco AsyncOS, Secure Email Gateway und Secure Web Appliance: Mehrere Schwachstellen
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Cisco AsyncOS ist ein Betriebssystem für Cisco Appliances. Das Cisco Secure Email Gateway ist eine Sicherheitslösung zum Schutz der E-Mail Kommunikation. Cisco Secure Web Appliance (ehem. Cisco Web Security) bietet einen on-premise Web Proxy mit Schutz vor vielen Bedrohungen.
Angriff: Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Cisco AsyncOS, Cisco Secure Email Gateway und Cisco Secure Web Appliance ausnutzen, um beliebigen Code mit Administratorrechten auszuführen, Root-Rechte zu erlangen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuführen.
Betroffene Betriebssysteme: - CISCO Appliance
CVE-2025-20184
Affected products
Product Identifier Version Remediation
Cisco AsyncOS Email Gateway <16.0.1-017
Cisco / AsyncOS
 Email Gateway <16.0.1-017
Cisco AsyncOS Email Gateway <15.5.3-022
Cisco / AsyncOS
 Email Gateway <15.5.3-022
Cisco Secure Email Gateway <16.0.0-050
Cisco / Secure Email Gateway
 <16.0.0-050
Cisco Secure Email Gateway <15.0.3-002
Cisco / Secure Email Gateway
 <15.0.3-002
Cisco AsyncOS Web Appliance <15.2.2-009
Cisco / AsyncOS
 Web Appliance <15.2.2-009
CVE-2025-20185
Affected products
Product Identifier Version Remediation
Cisco AsyncOS Email Gateway <16.0.1-017
Cisco / AsyncOS
 Email Gateway <16.0.1-017
Cisco AsyncOS Email Gateway <15.5.3-022
Cisco / AsyncOS
 Email Gateway <15.5.3-022
Cisco AsyncOS Web Appliance <15.2.1-011
Cisco / AsyncOS
 Web Appliance <15.2.1-011
Cisco AsyncOS Email and Web Manager <16.0.1-010
Cisco / AsyncOS
 Email and Web Manager <16.0.1-010
Cisco AsyncOS Web Appliance <15.0.1-004
Cisco / AsyncOS
 Web Appliance <15.0.1-004
Cisco AsyncOS Email and Web Manager <15.5.3-017
Cisco / AsyncOS
 Email and Web Manager <15.5.3-017
Cisco Secure Web Appliance <15.2.1-010
Cisco / Secure Web Appliance
 <15.2.1-010
Cisco Secure Web Appliance <15.0.1-004
Cisco / Secure Web Appliance
 <15.0.1-004
Cisco Secure Email Gateway <16.0.0-050
Cisco / Secure Email Gateway
 <16.0.0-050
Cisco Secure Email Gateway <15.5.2-018
Cisco / Secure Email Gateway
 <15.5.2-018
Cisco Secure Email Gateway <15.0.3-002
Cisco / Secure Email Gateway
 <15.0.3-002
Cisco AsyncOS Web Appliance <15.2.2-009
Cisco / AsyncOS
 Web Appliance <15.2.2-009
CVE-2025-20180
Affected products
Product Identifier Version Remediation
Cisco AsyncOS Email Gateway <16.0.1-017
Cisco / AsyncOS
 Email Gateway <16.0.1-017
Cisco AsyncOS Email Gateway <15.5.3-022
Cisco / AsyncOS
 Email Gateway <15.5.3-022
Cisco AsyncOS Email and Web Manager <16.0.1-010
Cisco / AsyncOS
 Email and Web Manager <16.0.1-010
Cisco AsyncOS Email and Web Manager <15.5.3-017
Cisco / AsyncOS
 Email and Web Manager <15.5.3-017
Cisco Secure Email Gateway <16.0.0-050
Cisco / Secure Email Gateway
 <16.0.0-050
Cisco Secure Email Gateway <15.5.2-018
Cisco / Secure Email Gateway
 <15.5.2-018
Cisco Secure Email Gateway <15.0.3-002
Cisco / Secure Email Gateway
 <15.0.3-002
CVE-2025-20183
Affected products
Product Identifier Version Remediation
Cisco AsyncOS Web Appliance <15.2.1-011
Cisco / AsyncOS
 Web Appliance <15.2.1-011
Cisco AsyncOS Web Appliance <15.0.1-004
Cisco / AsyncOS
 Web Appliance <15.0.1-004
Cisco Secure Web Appliance <15.2.1-010
Cisco / Secure Web Appliance
 <15.2.1-010
Cisco Secure Web Appliance <15.0.1-004
Cisco / Secure Web Appliance
 <15.0.1-004
CVE-2025-20207
Affected products
Product Identifier Version Remediation
Cisco Secure Web Appliance <15.2.1-010
Cisco / Secure Web Appliance
 <15.2.1-010
Cisco Secure Web Appliance <15.0.1-004
Cisco / Secure Web Appliance
 <15.0.1-004
Cisco Secure Email Gateway <16.0.0-050
Cisco / Secure Email Gateway
 <16.0.0-050
Cisco Secure Email Gateway <15.5.2-018
Cisco / Secure Email Gateway
 <15.5.2-018
Cisco Secure Email Gateway <15.0.3-002
Cisco / Secure Email Gateway
 <15.0.3-002
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Cisco AsyncOS ist ein Betriebssystem f\u00fcr Cisco Appliances.\r\nDas Cisco Secure Email Gateway ist eine Sicherheitsl\u00f6sung zum Schutz der E-Mail Kommunikation.\r\nCisco Secure Web Appliance (ehem. Cisco Web Security) bietet einen on-premise Web Proxy mit Schutz vor vielen Bedrohungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Cisco AsyncOS, Cisco Secure Email Gateway und Cisco Secure Web Appliance ausnutzen, um beliebigen Code mit Administratorrechten auszuf\u00fchren, Root-Rechte zu erlangen, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- CISCO Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-0276 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0276.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-0276 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0276"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-esa-sma-wsa-multi-yKUJhS34 vom 2025-02-05",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-multi-yKUJhS34"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-esa-sma-wsa-snmp-inf-FqPvL8sX vom 2025-02-05",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-snmp-inf-FqPvL8sX"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-esa-sma-xss-WCk2WcuG vom 2025-02-05",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-xss-WCk2WcuG"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-swa-range-bypass-2BsEHYSu vom 2025-02-05",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swa-range-bypass-2BsEHYSu"
      }
    ],
    "source_lang": "en-US",
    "title": "Cisco AsyncOS, Secure Email Gateway und Secure Web Appliance: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-02-05T23:00:00.000+00:00",
      "generator": {
        "date": "2026-07-16T17:15:59.522+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2025-0276",
      "initial_release_date": "2025-02-05T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-02-05T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Email and Web Manager \u003c15.5.3-017",
                "product": {
                  "name": "Cisco AsyncOS Email and Web Manager \u003c15.5.3-017",
                  "product_id": "T040826"
                }
              },
              {
                "category": "product_version",
                "name": "Email and Web Manager 15.5.3-017",
                "product": {
                  "name": "Cisco AsyncOS Email and Web Manager 15.5.3-017",
                  "product_id": "T040826-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:email_and_web_manager__15.5.3-017"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Email and Web Manager \u003c16.0.1-010",
                "product": {
                  "name": "Cisco AsyncOS Email and Web Manager \u003c16.0.1-010",
                  "product_id": "T040827"
                }
              },
              {
                "category": "product_version",
                "name": "Email and Web Manager 16.0.1-010",
                "product": {
                  "name": "Cisco AsyncOS Email and Web Manager 16.0.1-010",
                  "product_id": "T040827-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:email_and_web_manager__16.0.1-010"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Email Gateway \u003c15.5.3-022",
                "product": {
                  "name": "Cisco AsyncOS Email Gateway \u003c15.5.3-022",
                  "product_id": "T040828"
                }
              },
              {
                "category": "product_version",
                "name": "Email Gateway 15.5.3-022",
                "product": {
                  "name": "Cisco AsyncOS Email Gateway 15.5.3-022",
                  "product_id": "T040828-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:email_gateway__15.5.3-022"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Email Gateway \u003c16.0.1-017",
                "product": {
                  "name": "Cisco AsyncOS Email Gateway \u003c16.0.1-017",
                  "product_id": "T040829"
                }
              },
              {
                "category": "product_version",
                "name": "Email Gateway 16.0.1-017",
                "product": {
                  "name": "Cisco AsyncOS Email Gateway 16.0.1-017",
                  "product_id": "T040829-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:email_gateway__16.0.1-017"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Web Appliance \u003c15.2.2-009",
                "product": {
                  "name": "Cisco AsyncOS Web Appliance \u003c15.2.2-009",
                  "product_id": "T040830"
                }
              },
              {
                "category": "product_version",
                "name": "Web Appliance 15.2.2-009",
                "product": {
                  "name": "Cisco AsyncOS Web Appliance 15.2.2-009",
                  "product_id": "T040830-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:web_appliance__15.2.2-009"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Web Appliance \u003c15.0.1-004",
                "product": {
                  "name": "Cisco AsyncOS Web Appliance \u003c15.0.1-004",
                  "product_id": "T040837"
                }
              },
              {
                "category": "product_version",
                "name": "Web Appliance 15.0.1-004",
                "product": {
                  "name": "Cisco AsyncOS Web Appliance 15.0.1-004",
                  "product_id": "T040837-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:web_appliance__15.0.1-004"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Web Appliance \u003c15.2.1-011",
                "product": {
                  "name": "Cisco AsyncOS Web Appliance \u003c15.2.1-011",
                  "product_id": "T040838"
                }
              },
              {
                "category": "product_version",
                "name": "Web Appliance 15.2.1-011",
                "product": {
                  "name": "Cisco AsyncOS Web Appliance 15.2.1-011",
                  "product_id": "T040838-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:web_appliance__15.2.1-011"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AsyncOS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c15.0.3-002",
                "product": {
                  "name": "Cisco Secure Email Gateway \u003c15.0.3-002",
                  "product_id": "T040832"
                }
              },
              {
                "category": "product_version",
                "name": "15.0.3-002",
                "product": {
                  "name": "Cisco Secure Email Gateway 15.0.3-002",
                  "product_id": "T040832-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:secure_email_gateway:15.0.3-002"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c15.5.2-018",
                "product": {
                  "name": "Cisco Secure Email Gateway \u003c15.5.2-018",
                  "product_id": "T040833"
                }
              },
              {
                "category": "product_version",
                "name": "15.5.2-018",
                "product": {
                  "name": "Cisco Secure Email Gateway 15.5.2-018",
                  "product_id": "T040833-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:secure_email_gateway:15.5.2-018"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c16.0.0-050",
                "product": {
                  "name": "Cisco Secure Email Gateway \u003c16.0.0-050",
                  "product_id": "T040834"
                }
              },
              {
                "category": "product_version",
                "name": "16.0.0-050",
                "product": {
                  "name": "Cisco Secure Email Gateway 16.0.0-050",
                  "product_id": "T040834-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:secure_email_gateway:16.0.0-050"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Secure Email Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c15.0.1-004",
                "product": {
                  "name": "Cisco Secure Web Appliance \u003c15.0.1-004",
                  "product_id": "T040835"
                }
              },
              {
                "category": "product_version",
                "name": "15.0.1-004",
                "product": {
                  "name": "Cisco Secure Web Appliance 15.0.1-004",
                  "product_id": "T040835-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:secure_web_appliance:15.0.1-004"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c15.2.1-010",
                "product": {
                  "name": "Cisco Secure Web Appliance \u003c15.2.1-010",
                  "product_id": "T040836"
                }
              },
              {
                "category": "product_version",
                "name": "15.2.1-010",
                "product": {
                  "name": "Cisco Secure Web Appliance 15.2.1-010",
                  "product_id": "T040836-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:cisco:secure_web_appliance:15.2.1-010"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Secure Web Appliance"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-20184",
      "product_status": {
        "known_affected": [
          "T040829",
          "T040828",
          "T040834",
          "T040832",
          "T040830"
        ]
      },
      "release_date": "2025-02-05T23:00:00.000+00:00",
      "title": "CVE-2025-20184"
    },
    {
      "cve": "CVE-2025-20185",
      "product_status": {
        "known_affected": [
          "T040829",
          "T040828",
          "T040838",
          "T040827",
          "T040837",
          "T040826",
          "T040836",
          "T040835",
          "T040834",
          "T040833",
          "T040832",
          "T040830"
        ]
      },
      "release_date": "2025-02-05T23:00:00.000+00:00",
      "title": "CVE-2025-20185"
    },
    {
      "cve": "CVE-2025-20180",
      "product_status": {
        "known_affected": [
          "T040829",
          "T040828",
          "T040827",
          "T040826",
          "T040834",
          "T040833",
          "T040832"
        ]
      },
      "release_date": "2025-02-05T23:00:00.000+00:00",
      "title": "CVE-2025-20180"
    },
    {
      "cve": "CVE-2025-20183",
      "product_status": {
        "known_affected": [
          "T040838",
          "T040837",
          "T040836",
          "T040835"
        ]
      },
      "release_date": "2025-02-05T23:00:00.000+00:00",
      "title": "CVE-2025-20183"
    },
    {
      "cve": "CVE-2025-20207",
      "product_status": {
        "known_affected": [
          "T040836",
          "T040835",
          "T040834",
          "T040833",
          "T040832"
        ]
      },
      "release_date": "2025-02-05T23:00:00.000+00:00",
      "title": "CVE-2025-20207"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.