Cisco says Chinese hackers are exploiting an unpatched AsyncOS zero-day flaw – here's what we know so far

Cisco has issued a warning to customers after revealing China-linked hackers are exploiting a new high-severity zero day flaw in some security products.

Products targeted in the campaign include Cisco AsyncOS Software for Cisco Secure Email Gateway, formerly known as Cisco Email Security Appliance (ESA), and Cisco Secure Email and Web Manager, formerly known as Cisco Content Security Management Appliance (SMA).

Cisco Secure Email and Web Manager centralizes management and reporting functions across a number of Cisco ESAs and Web Security Appliances (WSAs), offering centralized services such as spam quarantine, policy management, reporting, tracking, and configuration management.

The currently unpatched vulnerability, tracked as CVE-2025-20393, has a CVSS score of 10.0.

Cisco said it became aware of the issue on December 10, and that the activity has been ongoing since at least late November. It's been hitting appliances with certain non-standard configurations that leave some ports open to the internet.

It's not known how many customers have been affected.

The attack involves a custom persistence mechanism that Cisco is tracking as “AquaShell”, along with additional tooling meant for reverse tunneling and purging logs.

"This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance," the firm said.

"The ongoing investigation has revealed evidence of a persistence mechanism planted by the threat actors to maintain a degree of control over compromised appliances."

Cisco is attributing the attacks to a group tracked as UAT-9686, a Chinese-nexus advanced persistent threat (APT) actor.

"We have observed overlaps in tactics, techniques and procedures (TTPs), infrastructure, and victimology between UAT-9686 and other Chinese-nexus threat actors Talos tracks," said the company's Talos researchers.

"Tooling used by UAT-9686, such as AquaTunnel (aka ReverseSSH), also aligns with previously disclosed Chinese-nexus APT groups such as APT41 and UNC5174. Additionally, the tactic of using a custom-made web-based implant such as AquaShell is increasingly being adopted by highly sophisticated Chinese-nexus APTs."

How to mitigate AquaShell threats

AquaShell is a lightweight Python backdoor that is embedded into an existing file within a Python-based web server that can receive encoded commands and execute them in the system shell.

If customers identify an appliance as having the web management interface or the Spam Quarantine port exposed to and reachable from the internet, Cisco said it strongly recommends following a multi-step process to restore the appliance to a secure configuration, when possible.

If this can't be done, customers should contact Cisco's Technical Assistance Center to check whether the appliance has been compromised. If it has, rebuilding the appliances is, currently, the only way to eradicate the threat actor's persistence mechanism from the appliance.

Cisco also strongly recommends restricting access to the appliance and implementing robust access control mechanisms to make sure that ports are not exposed to unsecured networks.

FOLLOW US ON SOCIAL MEDIA

Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.