Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cisco has released updates for the AsyncOS zero-day CVE-2025-20393, so the original “unpatched” warning is no longer current. The flaw was exploited against a limited subset of internet-exposed appliances. Organizations using Cisco Secure Email Gateway or Cisco Secure Email and Web Manager should check whether Spam Quarantine is enabled and internet-reachable, then upgrade to the fixed release for their product and software branch.
What happened with the AsyncOS zero-day?
CVE-2025-20393 is a critical remote command execution vulnerability in the Spam Quarantine feature of Cisco AsyncOS for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Cisco became aware of attacks on December 10, 2025, and published its advisory on December 17, 2025. The advisory was last updated January 15, 2026; Cisco says its investigation is concluded and it does not currently anticipate another update. Cisco’s security advisory gives the issue a CVSS 3.1 base score of 10.0, with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
The “unpatched” wording described the situation before Cisco released updates. The company says its software updates remediate the vulnerability and clear persistence mechanisms identified in the reported campaign.
Which appliances are at risk?
The affected products are physical and virtual Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running a vulnerable AsyncOS release. Exposure depends on configuration: Spam Quarantine must be enabled, and the feature must also be reachable from the internet. Running an affected product alone does not establish that an appliance is exposed. Cisco says Cisco Secure Email Cloud devices are not affected.
Spam Quarantine is not enabled by default, and Cisco product deployment guides do not require exposing it directly to the internet. Check its setting in the appliance web management interface:
- Secure Email Gateway: Network > IP Interfaces > select the interface.
- Secure Email and Web Manager: Management Appliance > Network > IP Interfaces > select the interface.
A checked Spam Quarantine box means the feature is enabled. That check does not tell you whether the interface can be reached from the internet; assess network routing and access controls separately.
Rank #2
- Stateful firewall throughput: 450 Mbps.
- Recommended maximum clients: 50.
- Managed centrally over the web. Classifies applications, users and devices.
- Layer 7 application visibility and traffic shaping. Application prioritization.
- Dimensions: 9.4 x 5.1 x 1.1 inches. Weight: 1.54 lbs (24.69 ounces).
What can an attacker do?
Cisco says the vulnerability results from insufficient validation of HTTP requests to Spam Quarantine. An unauthenticated remote attacker can send a crafted HTTP request and, if successful, execute arbitrary commands with root privileges on the appliance. Cisco reported that attackers implanted a persistent covert channel for remote access. The advisory does not provide an affected-device count or identify a broader victim population.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhich AsyncOS release fixes the vulnerability?
Use the row matching both the appliance product and its current AsyncOS branch. Secure Email Gateway and Secure Email and Web Manager have different fixed releases; do not apply one product’s row to the other.
Rank #3
- 10 × GbE (2 WAN, 2 PoE+), 1 × USB 2.0 for 3G/4G failover
- Stateful firewall throughput: 450 Mbps, VPN throughput: 200 Mbps
- Recommended maximum clients: 50, Layer 7 application visibility and traffic shaping
- Automatic firmware upgrades and security patches, VLAN support and DHCP services
- Includes 100W DC Power Supply, requires Enterprise or Advanced Security License
| Product | AsyncOS branch | First fixed release |
|---|---|---|
| Secure Email Gateway | 14.2 and earlier | 15.0.5-016 |
| Secure Email Gateway | 15.0 | 15.0.5-016 |
| Secure Email Gateway | 15.5 | 15.5.4-012 |
| Secure Email Gateway | 16.0 | 16.0.4-016 |
| Secure Email and Web Manager | 15.0 and earlier | 15.0.2-007 |
| Secure Email and Web Manager | 15.5 | 15.5.4-007 |
| Secure Email and Web Manager | 16.0 | 16.0.4-010 |
These are first fixed releases listed in Cisco’s advisory, not a statement that every later upgrade path is supported for every appliance. Cisco says updates can be installed through the appliance’s web management interface or CLI. Confirm that the hardware and software configuration is supported; if the correct upgrade path is unclear, consult Cisco Technical Assistance Center (TAC) or a contracted maintenance provider.
What should administrators do?
- Check the product, branch, and release. Identify whether each appliance is a Secure Email Gateway or Secure Email and Web Manager, then compare its AsyncOS branch with Cisco’s fixed-release table.
- Check Spam Quarantine and internet reachability. Use the applicable interface path above to see whether the feature is enabled, then verify whether it is accessible from the internet.
- Upgrade to the applicable fixed release. Use the appliance web interface or CLI, following Cisco’s supported upgrade guidance for the hardware and software configuration.
- Harden network access. Prevent access from unsecured networks. If internet access is necessary, restrict it to trusted hosts and documented ports and protocols. Place appliances behind a filtering device such as a firewall; on Secure Email Gateway, separate mail and management interfaces.
- Review services and logging. Disable unneeded network services. Monitor web logs and, where possible, retain them externally.
- Contact Cisco TAC if compromise confirmation is needed. Cisco recommends TAC for explicit confirmation of whether an appliance was compromised.
Cisco says there are no workarounds that directly mitigate this vulnerability. Network restrictions reduce exposure but are not a substitute for installing a fixed release.
Rank #4
![Cisco Meraki MX68CW-HW Network Security Firewall Appliance w/ Power Adapter & Antennas [Unclaimed & No License] (Renewed)](https://m.media-amazon.com/images/I/111X4NJOsaL._SL160_.jpg)
- MX68CW include a SIM slot and internal LTE modem. This integrated functionality removes the need for external hardware and allows for cellular visibility and configuration within the Meraki dashboard.
- One CAT 6, 300 Mbps LTE modem + 1 x Nano SIM slot (4ff form factor) +++ Global coverage with individual orderable SKUs for North America and worldwide
- MX68CW include two ports with 802.3at (PoE+). This built-in power capability removes the need for additional hardware to power critical branch devices.
- WAN: 2 GbE, one Cat 6 modem, one USB (cellular failover) + LAN: 10 GbE (two PoE+); Wi-Fi: 802.11ac Wave 2 + 600 Mbps firewall throughput
- Supports up to 50 users + 300 Mbps site-to-site VPN throughput
Why the original warning has changed
The advisory’s current status is materially different from the earlier “unpatched” alert: Cisco now lists fixes for both products and says the flaw has been remediated. Its statement that the fix clears persistence mechanisms identified in this campaign applies to those mechanisms; it does not replace Cisco TAC’s role when an organization needs explicit confirmation of compromise.
Quick Recap
Best Value
- 2 X 10/100/1000 + 2 X GIGABIT SFP
- CHASIS 64 GB MSATA
- DC POWER
- DIN RAIL MOUNTABLE
- INDUSTRIAL SECURITY APPLIANCE
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
