Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 18-Dec-2025 02:33:29 JST Kevin Beaumont

   Cisco have found an in the wild zero day in Cisco Secure Email Gateway And Cisco Secure Email and Web Manager being used to backdoor appliances for later access.

   Now CVE-2025-20393.

   No patch available.

   They recommend nuking boxes and reinstalling from scratch if you opened spam quarantine port (6025) to internet, and closing port.

   It is unclear how long boxes have been backdoored for.

   Port isn't scanned by @shodan yet so scope isn't known.

   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4