← Vulnerability feed

Vulnerability record · CVE-2024-20401 · published 17 July 2024

CVE-2024-20401: Cisco secure email gateway vulnerability

Cisco · Secure Email Gateway

A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device. Note: Manual intervention is required to recover from the DoS condition. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition.

9.8 CVSS 3.1 Critical EPSS 2.3% · top 17.5% CWE-36 · CWE-36
9.8CVSS 3.1 base score
2.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device. Note: Manual intervention is required to recover from the DoS condition. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-bGG2UsjH Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-bGG2UsjH Vendor Advisory

Track CVE-2024-20401 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.1CVE-2023-20120Cisco secure email and web manager cross-site scripting vulnerabilityMultiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email G…EPSS 0.47%6.1CVE-2023-20119Cisco secure email and web manager cross-site scripting vulnerabilityA vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Sec…EPSS 0.51%5.4CVE-2023-20028Cisco secure email and web manager cross-site scripting vulnerabilityMultiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email G…EPSS 0.47%5.3CVE-2025-20153Cisco secure email gateway improper access control vulnerabilityA vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configur…EPSS 0.36%5.5CVE-2025-39964Linux kernel af_alg race condition allows concurrent socket writesThe Linux kernel's af_alg crypto socket implementation did not prevent two concurrent writes to the same socket, allowing data to be interleaved unpr…KEVEPSS 1.3%analysed7.4CVE-2015-3246libuser userhelper direct /etc/passwd write race conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of …KEVEPSS 8.4%analysed7.0CVE-2025-62215Windows Kernel race condition and double free privilege escalationA race condition combined with a double free in the Windows Kernel lets a locally authenticated attacker corrupt kernel memory and elevate privileges…KEVEPSS 4.5%analysed7.8CVE-2025-38352Linux kernel POSIX CPU timer TOCTOU race enables local privilege escalationA time-of-check to time-of-use race exists in the Linux kernel between handle_posix_cpu_timers() and posix_cpu_timer_del(). When an exiting non-autor…KEVEPSS 1.3%analysed

Source: NIST National Vulnerability Database (record CVE-2024-20401), CISA KEV, FIRST EPSS (scores of 2026-10-12). This page is refreshed as NVD updates the record.