InfoSecBulletin Cybersecurity for mankind
A simple Python script to help organizations quickly detect exposure to CVE-2025-20393, a critical zero-day vulnerability in Cisco Secure Email Gateway (SEG) and Secure Malware Analytics (SMA).
The “Cisco SMA Exposure Check” tool identifies open ports and services exploited in recent attacks, as noted in Cisco’s advisory.
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
GitHub user StasonJatham released a script today that identifies indicators of compromise related to a vulnerability. This flaw lets unauthorized remote attackers run arbitrary code through exposed management and quarantine interfaces.
Attackers are exploiting ports such as TCP 82, 83, 443, 8080, 8443, and 9443 for admin access, and targeting quarantine endpoints on 6025, 82, 83, 8443, and 9443.
The tool scans and identifies HTTP/S signatures by examining server headers, status codes, redirects, authentication realms, Cisco keywords, and version patterns. It also checks common paths like /quarantine, /spamquarantine, /spam, /sma-login, and /login.
It also grabs raw socket banners and flags indicators of active exploitation, including strings like “AquaShell,” “AquaTunnel,” “Chisel,” and “AquaPurge” – hallmarks of post-compromise tools observed in the wild.
The script, using only Python 3’s standard library, executes in seconds.
Results highlight vulnerable configurations, allowing admins to urgently firewall ports, apply Cisco patches, or isolate systems.
Cisco warns of active exploitation and urges immediate action. No CVSS score is available, but the vulnerability could lead to unauthenticated remote code execution, similar to previous SMA issues.
