- Cisco confirms zero‑day (CVE‑2025‑20393) in Safe Electronic mail home equipment exploited by China‑linked actors
- Attackers deployed Aquashell backdoor, tunneling instruments, and log‑clearing utilities for persistence
- CISA added flaw to KEV; businesses should remediate/cease use by December 24
A China-affiliated risk actor has been abusing a zero-day vulnerability in a number of Cisco e-mail home equipment to achieve entry to the underlying system and set up persistence.
Cisco confirmed the information in a weblog put up and a safety advisory, urging customers to use offered suggestions and harden their networks.
In its announcement, Cisco said it first spotted the activity on December 10, and determined that it started at least in late November 2025. In the campaign, the threat actor tracked as UAT-9686 abused a bug in Cisco AsyncOS Software for Cisco Secure Email Gateway, and Cisco Safe Electronic mail and Net Supervisor, to execute system-level instructions and deploy a persistent Python-based backdoor referred to as Aquashell.
Two groups
The vulnerability is now tracked as CVE-2025-20393 and was given a severity score of 10/10 (critical).
The group was also seen deploying AquaTunnel (a reverse SSH tunnel) chisel (another tunneling tool), and AquaPurge (log-clearing utility).
Given the tools and infrastructure used, Cisco believes the attacks are being conducted by at least two groups – tracked as APT41, and UNC5174. Both are very active and quite dangerous – abusing legitimate cloud services, breaching VPNs, firewalls, and other tools, while engaging primarily in cyber-espionage.
At the same time, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog, confirming abuse in the wild. Federal Civilian Executive Branch agencies have until December 24 to apply the provided fixes or stop using the vulnerable products entirely.
In the advisory, Cisco said customers should restore the devices exposed to the internet to a secure configuration. If they are prevented from doing so, they should reach out to Cisco to see if they were compromised or not.
“In case of confirmed compromise, rebuilding the appliances is, currently, the only viable option to eradicate the threat actors’ persistence mechanism from the appliance,” Cisco said. “In addition, Cisco strongly recommends restricting access to the appliance and implementing robust access control mechanisms to ensure that ports are not exposed to unsecured networks.”
Via The Record
The very best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our knowledgeable information, opinions, and opinion in your feeds. Be sure that to click on the Observe button!
And naturally you may also follow TechRadar on TikTok for information, opinions, unboxings in video kind, and get common updates from us on WhatsApp too.
