Cisco Secure Email Gateway: Unauthenticated Root Command Execution via Crafted AMP Attachments

Cisco Secure Email Gateway contains a critical arbitrary file write vulnerability in its Advanced Malware Protection feature. This flaw allows an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. The issue arises from improper handling of email attachments when the file reputation service is active. Organizations using this gateway for email filtering are exposed to this risk if their configurations meet specific criteria.

Root cause

The vulnerability stems from how the system processes email attachments during the file reputation check. When the file reputation service is enabled and assigned to a mail policy, the device fails to properly sanitize or validate certain attachment properties. This improper handling creates a path for an attacker to manipulate the file writing process. The flaw is linked to CWE-23, which relates to path traversal issues.

Attack path

An attacker exploits this vulnerability by sending an email containing a specifically crafted attachment through an affected Cisco Secure Email Gateway device. The device processes the attachment as part of its standard security scanning routine. Because the file reputation service is enabled, the vulnerable code path is triggered. A successful exploit allows the attacker to write arbitrary files to the operating system and execute commands with root privileges.

Affected versions

• Cisco Secure Email Gateway, both physical and virtual appliances.
• Devices running a vulnerable release of Cisco AsyncOS Software.
• Systems with Content Scanner Tools version earlier than 25.3.0.5525.
• Environments where the File Reputation service is enabled and assigned to a mail policy.

Mitigation

• Upgrade to a fixed software release of Cisco Secure Email Gateway.
• Verify that Content Scanner Tools is version 25.3.0.5525 or later.
• Check if the File Reputation service is enabled in your mail policies.
• Review system logs for signs of compromise or failed security scans.

Signals worth monitoring

Teams should examine system logs for indicators of compromise related to file writing operations. Look for messages indicating suspected compromise or incomplete security scans. Administrators should check for unexpected file creation or modification events on the operating system. If a device is part of a cluster, review logs on each node. Contact support if suspicious activity is detected, as unauthorized root-level access may have occurred.

Background: Indicators of attack

Indicators of attack are behavioral patterns that signal an active adversary. Unlike static indicators of compromise, they focus on actions like lateral movement or data staging. Monitoring these behaviors allows security teams to detect and stop intrusions in progress, rather than reacting after damage is done.

Read the full guide: Indicators of Attack: Definition, Detection, and Practical Usage

What to do and how to stay safe: Cisco

• Check your Cisco Secure Email Gateway configuration to see if the File Reputation service is enabled.
• Verify the version of Content Scanner Tools running on your devices using the CLI.
• Update your devices to the latest patched software release provided by the vendor.
• Monitor system logs for any signs of unauthorized file writes or security scan failures.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for this vulnerability?

The CVSS score is 9.8, which is rated as Critical.

Are there any workarounds for this issue?

No, there are no workarounds available. You must upgrade to a fixed software release.

How can I check if my device is affected?

Check if File Reputation is enabled in your mail policies and verify that Content Scanner Tools is version 25.3.0.5525 or later.