CVE-2025-20207
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, remote attacker to obtain confidential information about the underlying operating system.
This vulnerability exists because the appliances do not protect confidential information at rest in response to SNMP poll requests. An attacker could exploit this vulnerability by sending a crafted SNMP poll request to the affected appliance. A successful exploit could allow the attacker to discover confidential information that should be restricted. To exploit this vulnerability, an attacker must have the configured SNMP credentials.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco Secure Email | 14.0.0-698 | affected |
| Cisco | Cisco Secure Email | 13.5.1-277 | affected |
| Cisco | Cisco Secure Email | 13.0.0-392 | affected |
| Cisco | Cisco Secure Email | 14.2.0-620 | affected |
| Cisco | Cisco Secure Email | 13.0.5-007 | affected |
| Cisco | Cisco Secure Email | 13.5.4-038 | affected |
| Cisco | Cisco Secure Email | 14.2.1-020 | affected |
| Cisco | Cisco Secure Email | 14.3.0-032 | affected |
| Cisco | Cisco Secure Email | 15.0.0-104 | affected |
| Cisco | Cisco Secure Email | 15.0.1-030 | affected |
| Cisco | Cisco Secure Email | 15.5.0-048 | affected |
| Cisco | Cisco Secure Email | 15.5.1-055 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.6.2-023 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.6.2-078 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.0.0-249 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.0.0-277 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.8.1-052 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.8.1-068 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.8.1-074 | affected |
| Cisco | Cisco Secure Email and Web Manager | 14.0.0-404 | affected |
| Cisco | Cisco Secure Email and Web Manager | 12.8.1-002 | affected |
| Cisco | Cisco Secure Email and Web Manager | 14.1.0-227 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.6.1-201 | affected |
| Cisco | Cisco Secure Email and Web Manager | 14.2.0-203 | affected |
| Cisco | Cisco Secure Email and Web Manager | 14.2.0-212 | affected |
| Cisco | Cisco Secure Email and Web Manager | 12.8.1-021 | affected |
| Cisco | Cisco Secure Email and Web Manager | 13.8.1-108 | affected |
| Cisco | Cisco Secure Email and Web Manager | 14.2.0-224 | affected |
| Cisco | Cisco Secure Email and Web Manager | 14.3.0-120 | affected |
| Cisco | Cisco Secure Email and Web Manager | 15.0.0-334 | affected |
| Cisco | Cisco Secure Email and Web Manager | 15.5.1-024 | affected |
| Cisco | Cisco Secure Email and Web Manager | 15.5.1-029 | affected |
| Cisco | Cisco Secure Web Appliance | 11.8.0-453 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.3-002 | affected |
| Cisco | Cisco Secure Web Appliance | 12.0.3-007 | affected |
| Cisco | Cisco Secure Web Appliance | 12.0.3-005 | affected |
| Cisco | Cisco Secure Web Appliance | 14.1.0-032 | affected |
| Cisco | Cisco Secure Web Appliance | 14.1.0-047 | affected |
| Cisco | Cisco Secure Web Appliance | 14.1.0-041 | affected |
| Cisco | Cisco Secure Web Appliance | 12.0.4-002 | affected |
| Cisco | Cisco Secure Web Appliance | 14.0.2-012 | affected |
| Cisco | Cisco Secure Web Appliance | 11.8.0-414 | affected |
| Cisco | Cisco Secure Web Appliance | 12.0.1-268 | affected |
| Cisco | Cisco Secure Web Appliance | 11.8.1-023 | affected |
| Cisco | Cisco Secure Web Appliance | 11.8.3-021 | affected |
| Cisco | Cisco Secure Web Appliance | 11.8.3-018 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.1-011 | affected |
| Cisco | Cisco Secure Web Appliance | 11.8.4-004 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.2-007 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.2-011 | affected |
| Cisco | Cisco Secure Web Appliance | 14.5.0-498 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.4-005 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.4-011 | affected |
| Cisco | Cisco Secure Web Appliance | 12.0.5-011 | affected |
| Cisco | Cisco Secure Web Appliance | 14.0.3-014 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.5-004 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.5-005 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.5-008 | affected |
| Cisco | Cisco Secure Web Appliance | 14.0.4-005 | affected |
| Cisco | Cisco Secure Web Appliance | 14.5.1-008 | affected |
| Cisco | Cisco Secure Web Appliance | 14.5.1-016 | affected |
| Cisco | Cisco Secure Web Appliance | 15.0.0-355 | affected |
| Cisco | Cisco Secure Web Appliance | 15.0.0-322 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.6-008 | affected |
| Cisco | Cisco Secure Web Appliance | 15.1.0-287 | affected |
| Cisco | Cisco Secure Web Appliance | 14.5.2-011 | affected |
| Cisco | Cisco Secure Web Appliance | 15.2.0-116 | affected |
| Cisco | Cisco Secure Web Appliance | 14.0.5-007 | affected |
| Cisco | Cisco Secure Web Appliance | 15.2.0-164 | affected |
| Cisco | Cisco Secure Web Appliance | 14.5.1-510 | affected |
| Cisco | Cisco Secure Web Appliance | 12.0.2-012 | affected |
| Cisco | Cisco Secure Web Appliance | 12.0.2-004 | affected |
| Cisco | Cisco Secure Web Appliance | 14.5.1-607 | affected |
| Cisco | Cisco Secure Web Appliance | 14.5.3-033 | affected |
| Cisco | Cisco Secure Web Appliance | 12.0.1-334 | affected |
| Cisco | Cisco Secure Web Appliance | 14.0.1-503 | affected |
| Cisco | Cisco Secure Web Appliance | 14.0.1-053 | affected |
| Cisco | Cisco Secure Web Appliance | 11.8.0-429 | affected |
| Cisco | Cisco Secure Web Appliance | 14.0.1-040 | affected |
| Cisco | Cisco Secure Web Appliance | 14.0.1-014 | affected |
| Cisco | Cisco Secure Web Appliance | 12.5.1-043 | affected |
Weaknesses
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.