A light-weight Python script to assist organizations rapidly establish publicity to CVE-2025-20393, a crucial zero-day vulnerability in Cisco Safe Electronic mail Gateway (SEG) and Safe Malware Analytics (SMA), also referred to as Cisco Safe Electronic mail and Net Supervisor.
The instrument “Cisco SMA Publicity Test” detects open ports and providers which have been exploited in current assaults, as detailed in Cisco’s advisory.
Developed by GitHub person StasonJatham and launched publicly at present, the script targets indicators of compromise tied to the flaw, which permits unauthenticated distant attackers to execute arbitrary code by way of uncovered administration and quarantine interfaces.
Attackers have weaponized ports like TCP 82, 83, 443, 8080, 8443, and 9443 for admin entry, alongside quarantine endpoints on 6025, 82, 83, 8443, and 9443.
The instrument scans these, performs HTTP/S fingerprinting (server headers, standing codes, redirects, auth realms, Cisco-specific key phrases, and model patterns), and checks widespread paths corresponding to /quarantine, /spamquarantine, /spam, /sma-login, and /login.
It additionally grabs uncooked socket banners and flags indicators of lively exploitation, together with strings like “AquaShell,” “AquaTunnel,” “Chisel,” and “AquaPurge” – hallmarks of post-compromise instruments noticed within the wild.
Easy Deployment, No Dependencies
Requiring solely Python 3’s commonplace library, the script runs in seconds:
textpython3 cisco-sa-sma-attack-N9bf4.py [-v] [-t ]
-v: Verbose mode reveals all checks.
-t: Customized timeout (default: fast probes).
Helps domains or direct IPs (bypasses DNS).
Port TypeExposed PortsRisk LevelAdmin/Mgmt82, 83, 443, 8080, 8443, 9443CriticalQuarantine/Spam6025, 82, 83, 8443, 9443High
Outcomes flag weak configs, enabling admins to firewall ports, apply Cisco patches, or isolate programs urgently.
Cisco’s advisory warns of lively exploitation, urging instant mitigation. With no CVSS rating revealed but, the vulnerability’s unauthenticated RCE potential echoes previous SMA flaws.
This instrument fills a detection hole, empowering SecOps groups sans industrial scanners. StasonJatham stresses accountable use: “Solely take a look at licensed programs.”
Comply with us on Google Information, LinkedIn, and X for every day cybersecurity updates. Contact us to characteristic your tales.
