Vulnerability in Cisco Asyncos
CVE-2025-20185
A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attac…
EPSS: 0.002 (8.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.4 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Cisco Asyncos — versions 13.0.0-392, 13.0.5-007, 13.5.1-277
- Cisco Secure Email — versions 14.0.0-698, 13.5.1-277, 13.0.0-392
- Cisco Secure Email And Web Manager — versions 13.6.2-023, 13.6.2-078, 13.0.0-249
- Cisco Secure Web Appliance — versions 11.8.0-453, 12.5.3-002, 12.0.3-007
- Cisco Secure_email_and_web_manager_m170
- Cisco Secure_email_and_web_manager_m190
- Cisco Secure_email_and_web_manager_m195
- Cisco Secure_email_and_web_manager_m380
- Cisco Secure_email_and_web_manager_m390
- Cisco Secure_email_and_web_manager_m390x
Weakness classification (CWE)
References
- psirt@cisco.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-20185?
- CVE-2025-20185 is a low-severity vulnerability in Cisco Asyncos, classified under CWE-250. CVSS score: 3.4/10. Published 2025-02-05.
- How severe is CVE-2025-20185?
- Low severity. CVSS v3 base score is 3.4 out of 10.