dbcve.org
Email Security ApplianceApplication · Cisco

CVE-2023-20009

HIGH · 7.2 CVSS v3.1 Published 2023-03-01
Fix available
A fix is available. Upgrade to 12.5.3-041 / 12.8.1-021 or later.
See remediation →
78/100
Remediation priority · High
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]]. The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is an authenticated privilege escalation vulnerability in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA). An attacker with valid operator-level credentials can upload a specially crafted SNMP configuration file through the Web UI or administrative CLI. When the device processes this malicious SNMP configuration, it allows arbitrary command execution with root privileges, enabling complete system compromise.

MitigationApply Cisco's security patches for CVE-2023-20009. Until patched, restrict administrative access to trusted personnel only and monitor for suspicious SNMP configuration file uploads.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Email Security ApplianceApplication
Affected:< 12.5.3-041>= 13.0.0, < 13.0.5-007>= 13.5.0, < 13.5.4-038>= 14.0.0, < 14.2.1-020>= 14.3.0, < 14.3.0-032
Secure Email And Web ManagerApplication
Affected:< 12.8.1-021>= 13.8.0, < 13.8.1-108>= 14.0.0, < 14.2.0-224>= 14.3.0, < 14.3.0-120

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check the installed version of Cisco Email Security Appliance (ESA) or Cisco Secure Email and Web Manager (SMA)
    Log into the device CLI and run the 'version' command, or access the Web UI About page. Compare your installed version number to the affected ranges: ESA: < 12.5.3-041, >= 13.0.0 < 13.0.5-007, >= 13.5.0 < 13.5.4-038, >= 14.0.0 < 14.2.1-020, >= 14.3.0 < 14.3.0-032. SMA: < 12.8.1-021, >= 13.8.0 < 13.8.1-108, >= 14.0.0 < 14.2.0-224, >= 14.3.0 < 14.3.0-120
    Affected if Your installed version falls within any of the listed vulnerable version ranges
  2. Determine if SNMP configuration upload functionality is accessible
    Log into the Web UI or CLI with operator-level credentials and navigate to the SNMP configuration section (typically under System Administration > SNMP or via the 'snmpconfig' CLI command). Verify if you can upload or modify SNMP configuration files.
    Affected if SNMP configuration upload is available and you have operator-level access to it
  3. Review audit logs for SNMP configuration file upload events
    Access the device logs (via the Web UI Logs > Ironport Text Mail Logs or CLI 'grep' commands) and search for entries containing 'snmp' and 'upload' or 'config' around the time of suspected activity. Check for any unexpected SNMP configuration changes.
    Affected if Unexpected SNMP configuration uploads appear in the logs from accounts you do not recognize
  4. Identify all accounts with operator-level or higher administrative privileges
    In the Web UI, go to System Administration > User Management > Users, or use the CLI 'userconfig' command to list all configured users and their privilege levels. Note which accounts have operator or administrator access.
    Affected if There are operator-level accounts beyond those you explicitly created or manage

You are affected if your device runs a vulnerable version AND operator-level credentials could be obtained by an attacker to upload malicious SNMP configurations.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 12.5.3-041 / 12.8.1-021 / 13.0.5-007 or later
Fixed in 12.5.3-04112.8.1-02113.0.5-007
Interim mitigation

Apply Cisco's security patches for CVE-2023-20009. Until patched, restrict administrative access to trusted personnel only and monitor for suspicious SNMP configuration file uploads.

Recommended fix High confidence

For ESA: 12.5.3-041, 13.0.5-007, 13.5.4-038, or 14.2.1-020 (or later). For SMA: 12.8.1-021, 13.8.1-108, 14.2.0-224, or 14.3.0-120 (or later)

  1. 1. Identify the current version of Cisco Secure Email Gateway (ESA) or Secure Email and Web Manager (SMA) by accessing the Web UI (System Administration > System Status) or running the 'version' command in the CLI
  2. 2. Determine which version branch your current installation falls into based on the affected version ranges provided
  3. 3. For Email Security Appliance: Upgrade to version 12.5.3-041 or later, 13.0.5-007 or later, 13.5.4-038 or later, or 14.2.1-020 or later depending on your current branch
  4. 4. For Secure Email And Web Manager: Upgrade to version 12.8.1-021 or later, 13.8.1-108 or later, 14.2.0-224 or later, or 14.3.0-120 or later depending on your current branch
  5. 5. Download the appropriate AsyncOS upgrade image from Cisco.com or your Cisco Smart Software Manager
  6. 6. Back up the current device configuration before performing the upgrade
  7. 7. Upload and install the upgrade via the Web UI (System Administration > Upgrade) or CLI using the 'upgrade' command
  8. 8. After upgrade completion, verify the new version is installed and the SNMP configuration functions properly
Caveat Review Cisco release notes for your specific upgrade path for any configuration or compatibility notes; standard practice is to backup configuration before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Email Security Appliance Scoped from the published advisory
  • Consultation3.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA2.0 h
12.0 hours of engineering $2,130
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-20009 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-20009 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data