InfoSecBulletin Cybersecurity for mankind
A simple Python script to help organizations quickly detect exposure to CVE-2025-20393, a critical zero-day vulnerability in Cisco Secure Email Gateway (SEG) and Secure Malware Analytics (SMA).
The “Cisco SMA Exposure Check” tool identifies open ports and services exploited in recent attacks, as noted in Cisco’s advisory.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
GitHub user StasonJatham released a script today that identifies indicators of compromise related to a vulnerability. This flaw lets unauthorized remote attackers run arbitrary code through exposed management and quarantine interfaces.
Attackers are exploiting ports such as TCP 82, 83, 443, 8080, 8443, and 9443 for admin access, and targeting quarantine endpoints on 6025, 82, 83, 8443, and 9443.
The tool scans and identifies HTTP/S signatures by examining server headers, status codes, redirects, authentication realms, Cisco keywords, and version patterns. It also checks common paths like /quarantine, /spamquarantine, /spam, /sma-login, and /login.
It also grabs raw socket banners and flags indicators of active exploitation, including strings like “AquaShell,” “AquaTunnel,” “Chisel,” and “AquaPurge” – hallmarks of post-compromise tools observed in the wild.
The script, using only Python 3’s standard library, executes in seconds.
Results highlight vulnerable configurations, allowing admins to urgently firewall ports, apply Cisco patches, or isolate systems.
Cisco warns of active exploitation and urges immediate action. No CVSS score is available, but the vulnerability could lead to unauthenticated remote code execution, similar to previous SMA issues.
