CVE-2025-20393 — Cisco Secure Email Gateway RPC Integer Overflow Enabling Auth Bypass and Unsafe Pickle Deserialization (CVSS 10.0), Exploited by China-Nexus APT UAT-9686 — Threadlinqs Intelligence
As of 2026-02-05, CVE-2025-20393 — Cisco Secure Email Gateway RPC Integer Overflow Enabling Auth Bypass and Unsafe Pickle Deserialization (CVSS 10.0), Exploited by China-Nexus APT UAT-9686 is a critical-severity vulnerability threat attributed to UAT-9686 (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1541 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Attribution: UAT-9686 · China · ESPIONAGE
A single-byte integer overflow in the EUQ RPC message header of Cisco AsyncOS Software (Secure Email Gateway / Secure Email and Web Manager) lets an unauthenticated remote attacker bypass
CVE-2025-20393 affects the Spam Quarantine / End User Quarantine (EUQ) RPC service (TCP port 83, quarantine web UI commonly on port 6025) shipped in Cisco AsyncOS Software for Secure Email Gateway (formerly Email Security Appliance) and Secure Email and Web Manager (formerly Content Security Management Appliance). The EUQ RPC wire format uses the struct layout '>BBIIBB32s' (version, ttl, msg_len, msg_type, src_len, dst_len, txn_tag), where src_len and dst_len are single-byte unsigned-char fields (0-255). Because the service runs under Python 2.6 (EOL since 2013), struct.pack('>B', n) silently truncates n modulo 256 instead of raising struct.error as modern Python does. An attacker can therefore craft a payload whose true length is 256 or 289 bytes so that the encoded destination-length byte wraps to 0 (or to a value matching the appliance's known serial number). When the receiver's read_message() function evaluates 'if destination_length:', a wrapped-to-zero length causes destination to be set to an empty string, which bypasses the check that normally validates the message's destination against the appliance's serial number. The now-unauthenticated message body is then passed directly to cPickle.loads(), Python's insecure object deserializer, allowing an attacker-supplied pickle object with a __reduce__ gadget to execute arbitrary OS commands with root privileges via a single crafted HTTP request — no credentials, no user interaction. Cisco's advisory (cisco-sa-sma-attack-N9bf4, published 2025-12-17, updated 2026-01-15) describes the flaw generically as 'Insufficient validation of HTTP requests by the Spam Quarantine feature'; STAR Labs' 2026-02-05 patch-diffing research against AsyncOS 15.5.4 (which adds explicit destination-length validation) reverse-engineered the true integer-overflow/pickle root cause and published a working proof-of-concept demonstrating both the serial-matching and universal zero-length bypass techniques. Cisco Talos separately confirmed exploitation in the wild dating to at least late November 2025 by a Chinese-nexus actor tracked as UAT-9686 (moderate confidence), which Talos assesses shares TTP, infrastructure, and victimology overlaps with APT41 and UNC5174. Post-exploitation, UAT-9686 deployed a persistent Python backdoor (AquaShell) embedded into the appliance's existing EUQ web server file at /data/web/euq_webui/htdocs/index.py, a compiled Go ELF reverse-SSH tunneling implant derived from the open-source ReverseSSH project (AquaTunnel), the open-source Chisel tunneling tool for pivoting into internal networks, and a log-sanitization utility (AquaPurge) that uses egrep-style keyword filtering to strip incriminating lines from appliance logs. Exploitation requires the Spam Quarantine feature to be enabled and its EUQ/administrative interface exposed to the internet — not the default configuration, which limits the vulnerable population but does not reduce severity for exposed appliances. CISA added CVE-2025-20393 to the Known Exploited Vulnerabilities catalog on 2025-12-17 with a Federal Civilian Executive Branch remediation deadline of 2025-12-24. No workaround exists; Cisco recommends taking the Spam Quarantine feature off the internet, restricting access to trusted hosts, and rebuilding/reimaging any appliance confirmed compromised, since AquaShell and AquaTunnel persistence can survive simple config resets.
Weaknesses (CWE)
CWE-20, CWE-190, CWE-502, CWE-287
Target sectors: government administration, technology, critical-infrastructure, telecoms
Target regions: North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2025-20393, T1190, T1059, T1059.006, T1059.004, T1505.003, T1554, T1068, T1070.002, T1027, T1140