Medium severity · published Feb 19, 2025
CVE-2025-20153
A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules and allow emails that…
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules and allow emails that should have been denied to flow through an affected device.   This vulnerability is due to improper handling of email that passes through an affected device. An attacker could exploit this vulnerability by sending a crafted email through the affected device. A successful exploit could allow the attacker to bypass email filters on the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Secure Email Gateway · Cisco
13.0.0-392; 13.0.5-007; 13.5.1-277; 13.5.4-038; 14.0.0-698; 14.2.0-620; +9 more · source: NVD
Affected product
SE
Secure Email Gateway
Cisco
More from Secure Email Gateway
9.8
CVE-2026-76519
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
9.8
CVE-2026-76461
Cisco Secure Email Gateway SQL Injection Vulnerability
9.8
CVE-2024-20401
A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files…
6.1
CVE-2023-20120
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email…
6.1
CVE-2023-20119
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance…