Cisco AsyncOS Zero-Day Actively Exploited in Email Security Appliances

Cisco has issued a serious warning after discovering active cyberattacks exploiting a zero-day vulnerability in its AsyncOS software, which powers Cisco Secure Email Gateway (SEG) and Cisco Secure Email and Web Manager (SEWM) appliances. The flaw is already being abused in real-world attacks, making it a high-risk issue for organizations using these products.

The vulnerability, tracked as CVE-2025-20393, has been assigned the maximum CVSS score of 10.0, indicating critical severity. According to Cisco, the flaw allows attackers to gain root-level access and run arbitrary commands on affected systems.

Cisco confirmed that the attacks are being carried out by a China-linked advanced persistent threat (APT) group identified as UAT-9686. The company detected the intrusion campaign on December 10, 2025, but evidence suggests exploitation began as early as late November 2025.

The attackers targeted a limited number of Cisco appliances, mainly those with specific ports exposed to the internet. While Cisco has not disclosed how many customers are affected, the confirmed active exploitation makes this a serious concern for enterprises worldwide.

In its advisory, Cisco stated that the attackers were able to execute commands with full root privileges, giving them deep control over compromised devices. Even more concerning, investigators found evidence that the attackers installed persistent backdoors, allowing them to maintain long-term access.

CVE-2025-20393 is caused by improper input validation in Cisco AsyncOS. This weakness allows threat actors to send specially crafted requests that the system fails to properly sanitize, resulting in privilege escalation and remote command execution.

Importantly, all versions of Cisco AsyncOS are affected. However, successful exploitation requires two specific conditions to be met:

• The Spam Quarantine feature must be enabled

• The Spam Quarantine service must be accessible from the internet

Cisco noted that Spam Quarantine is not enabled by default, which reduces risk for some users. Still, organizations that enabled the feature without restricting internet access are particularly vulnerable.

Cisco advised administrators to verify whether the Spam Quarantine feature is active by following these steps:

1. Log in to the web management interface

2. Navigate to:

   • Network > IP Interfaces (for Secure Email Gateway), or

   • Management Appliance > Network > IP Interfaces (for Secure Email and Web Manager)

3. Select the interface used for Spam Quarantine

4. Check whether the Spam Quarantine option is enabled

If it is enabled and exposed externally, immediate action is required.

Cisco’s investigation revealed that UAT-9686 deployed multiple malicious tools after exploiting the zero-day vulnerability. These include:

• ReverseSSH (AquaTunnel) – a tunneling tool used to maintain remote access

• Chisel – another tunneling utility for bypassing network controls

• AquaPurge – a log-cleaning tool used to hide attacker activity

The use of AquaTunnel is significant, as it has previously been linked to well-known Chinese hacking groups such as APT41 and UNC5174.

Attackers also deployed a custom Python-based backdoor named AquaShell. This lightweight backdoor listens for unauthenticated HTTP POST requests containing specially encoded data. Once received, it decodes the data and executes commands directly on the system shell.

This method allows attackers to operate stealthily while avoiding traditional authentication controls.