Cisco Secure Email Gateway RCE (cisco-sa-sma-attack-N9bf4)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(290250);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/17");

  script_cve_id("CVE-2025-20393");
  script_xref(name:"IAVA", value:"2026-A-0059");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/12/24");

  script_name(english:"Cisco Secure Email Gateway RCE (cisco-sa-sma-attack-N9bf4)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Email Gateway is affected by a remote code execution vulnerability.
  
  - A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway
  and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary
  system commands on an affected device with root privileges. This vulnerability is due to insufficient
  validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by
  sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to
  execute arbitrary commands on the underlying operating system with root privileges. (CVE-2025-20393)

  Please see the included Cisco BID and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?edb9b75b");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCws52505");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCws52505");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20393");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:email_security_appliance");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_esa_version.nasl");
  script_require_keys("Host/AsyncOS/Cisco Email Security Appliance/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco Email Security Appliance (ESA)');

var vuln_ranges = [
  {'min_ver': '0', 'fix_ver' : '15.0.5.16'}, 
  {'min_ver': '15.5', 'fix_ver' : '15.5.4.12'},
  {'min_ver': '16.0', 'fix_ver' : '16.0.4.16'}
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCws52505'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);