Skip to content
Fencer Vulns
medium 6.5

CVE-2023-20009 json

A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) c…

published 2023-02-16 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24188

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]]. The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device.

Patch / fix

  • cisco email_security_appliance 12.5.3-041, 13.0.5-007, 13.5.4-038, 14.2.1-020, 14.3.0-032
  • cisco secure_email_and_web_manager 12.8.1-021, 13.8.1-108, 14.2.0-224, 14.3.0-120

Exploit prediction

2.23% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Cisco Cisco Secure Email
  • Cisco Cisco Secure Email and Web Manager

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.