Cisco Multiple Products Improper Input Validation Vulnerability

Cisco Multiple Products

Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. Added to CISA KEV on 2025-12-17 (federal deadline 2025-12-24).

First seen: 17 Dec 2025
Last update: 17 Dec 2025, 12:00 UTC
Identifiers: CVE-2025-20393
Source: CISA KEV
On the menu as: VPN & firewalls

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Cisco Multiple Products Improper Input Validation Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Cisco Multiple Products
Ids: CVE-2025-20393

Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. Added to CISA KEV on 2025-12-17 (federal deadline 2025-12-24).

## Steps
1. This touches infrastructure (vpn-edge). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-20393") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2025-20393
https://pwned.coffee/i/cisco-multiple-products-improper-input-validation-vulner-cve-2025-20393

Sources

NVD: CVE-2025-20393

Totalone hot coffee