Cisco AsyncOS 0-Day Allows Remote Execution of System Commands

Cisco Talos has uncovered an active campaign exploiting a zero-day vulnerability in Cisco AsyncOS Software, affecting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.

The security flaw enables attackers to execute system-level commands remotely and deploy sophisticated backdoors on compromised systems.

The threat actor behind this campaign, tracked as UAT-9686, is assessed with moderate confidence to be a Chinese-nexus advanced persistent threat group.

Cisco became aware of the malicious activity on December 10, 2025, though evidence suggests attacks have been ongoing since at least late November 2025.

Attack Methodology

UAT-9686 deploys a custom persistence mechanism called “AquaShell,” a lightweight Python backdoor embedded into existing files within Python-based web servers.

The backdoor listens for unauthenticated HTTP POST requests containing specially crafted data, which it decodes using a custom algorithm combined with Base64 decoding before executing commands on the compromised appliance.

The attack toolkit includes several additional tools. AquaTunnel, based on the open-source ReverseSSH backdoor, creates reverse SSH connections from compromised systems to attacker-controlled servers, enabling unauthorized remote access even behind firewalls.

Chisel, another tunneling tool, allows attackers to proxy traffic through compromised edge devices and pivot into internal networks.

AquaPurge removes incriminating evidence by clearing specific keywords from log files using the egrep command.

Cisco Talos has identified overlaps in tactics, techniques, procedures, infrastructure, and victimology between UAT-9686 and other known Chinese-nexus threat actors.

The tooling employed, particularly AquaTunnel, aligns with previously disclosed Chinese APT groups including APT41 and UNC5174.

The use of custom-made web-based implants like AquaShell represents an increasingly common tactic among sophisticated Chinese-nexus APTs.

Analysis indicates that appliances with non-standard configurations are primarily vulnerable to this attack, as detailed in Cisco’s security advisory.

Cisco customers are strongly urged to follow guidance published in official security advisories.

Organizations should check for connections to provided indicators of compromise and open cases with Cisco TAC if suspicious activity is detected. All IOCs associated with this campaign have been blocked across the Cisco portfolio.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.