New Tool Released to Detect Cisco Secure Email Gateway 0-Day Vulnerability Exploited in the Wild

Cybersecurity: Detection Tool for Cisco Secure Email Gateway Vulnerability

A new Python script has been developed to assist organizations in identifying exposure to CVE-2025-20393, a critical zero-day vulnerability in Cisco Secure Email Gateway (SEG) and Secure Malware Analytics (SMA). This tool, known as "Cisco SMA Exposure Check," facilitates the detection of compromised ports and services following recent attacks, as noted in Cisco's advisory.

The script, created by GitHub user StasonJatham, targets indicators of compromise associated with the flaw. This vulnerability allows unauthenticated remote attackers to execute arbitrary code through exposed management and quarantine interfaces.

Commonly targeted ports include TCP 82, 83, 443, 8080, 8443, and 9443 for administrative access, as well as quarantine endpoints on ports 6025, 82, 83, 8443, and 9443.

The tool scans these ports, performs HTTP/S fingerprinting, and checks common paths such as /quarantine and /login. It also identifies active exploitation indicators, such as specific strings associated with post-compromise tools.

The script requires only Python 3's standard library and executes swiftly:

python3 cisco-sa-sma-attack-N9bf4.py [-v] [-t <timeout-seconds>] <host-or-domain>

-v : Verbose mode for detailed checks. -t : Custom timeout option. Supports both domain names and direct IPs.

Port Type Exposed Ports Risk Level

Admin/Mgmt 82, 83, 443, 8080, 8443, 9443 Critical

Quarantine/Spam 6025, 82, 83, 8443, 9443 High

The results highlight vulnerable configurations, enabling administrators to take necessary actions such as firewall adjustments, applying Cisco patches, or system isolation.

Cisco's advisory emphasizes the urgency of mitigation due to active exploitation. While no CVSS score is available yet, the potential for remote code execution is significant.

This tool addresses a detection gap, providing security operations teams with a resource for systems without commercial scanners. It is recommended to use the tool responsibly and only on authorized systems.

Based on reporting by Cyber Security News.