Skip to content
fr Sign in
6.5 Medium

CVE-2023-20009 A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email…

Description

A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]]. The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device.

Affected products and versions

Product Affected versions Fixed in
Cisco Secure Email 14.2.0-620 No fix stated
Cisco Secure Email 14.0.0-698 No fix stated
Cisco Secure Email 13.5.1-277 No fix stated
Cisco Secure Email 13.0.0-392 No fix stated
Cisco Secure Email 12.5.0-066 No fix stated
Cisco Secure Email 12.1 12.1.0-071 → 12.1.0-089 No fix stated
Cisco Secure Email 12.0.0-419 No fix stated
Cisco Secure Email 11.1 11.1.0-069 → 11.1.0-131 No fix stated
Cisco Secure Email 11.0.3-238 No fix stated
Show the 11 other branches
Product Affected versions Fixed in
Cisco Secure Email and Web Manager 14.2.0-212 No fix stated
Cisco Secure Email and Web Manager 14.1 14.1.0-223 → 14.1.0-227 No fix stated
Cisco Secure Email and Web Manager 14.0.0-404 No fix stated
Cisco Secure Email and Web Manager 13.8 13.8.1-068 → 13.8.1-074 No fix stated
Cisco Secure Email and Web Manager 13.6.2-078 No fix stated
Cisco Secure Email and Web Manager 13.0.0-277 No fix stated
Cisco Secure Email and Web Manager 12.8.1-002 No fix stated
Cisco Secure Email and Web Manager 12.5 12.5.0-636 → 12.5.0-678 No fix stated
Cisco Secure Email and Web Manager 12.0 12.0.0-452 → 12.0.1-011 No fix stated
Cisco Secure Email and Web Manager 11.5.1-105 No fix stated
Cisco Secure Email and Web Manager 11.0 11.0.0-115 → 11.0.1-161 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Secure Email

The 29 CVEs of Cisco Secure Email →
CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability 9.8 Critical CVE-2026-76442 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and… 7.5 High CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability 9.8 Critical CVE-2026-76443 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and… 9.8 Critical
Track this CVE