China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear

Cisco has warned that a China-linked threat group is exploiting a new zero-day, tracked as CVE-2025-20393, to target some Secure Email Gateway and Secure Email and Web Manager appliances. The zero-day is described as critical and can be used to run arbitrary commands on the underlying OS with root privileges, with Cisco Talos saying the exploitation targeted a limited subset of appliances with certain ports open to the internet.

According to Talos, the attacks, which were first observed on December 10 and have been ongoing since at least late November, have been attributed to a threat actor tracked as UAT-9686, which it believes is a Chinese state-sponsored APT, with moderate confidence based on the tools and infrastructure used. The campaign has involved AquaShell, AquaPurge, and AquaTunnel, while Chisel has also been observed as an open source tunneling tool to facilitate movement.

Cisco has published indicators of compromise, and while no patches or clitches are identified in the advisory, CVE-2025-20393 has been added to the CISA Known Exploited Vulnerabilities catalog, with a deadline for federal agencies to address it by 24 December.