Critical Cisco bug lets hackers add root users on SEG devices

Cisco released a patch for CVE-2024-20401, a critical absolute path traversal in Security Email Gateway (SEG) content scanning that allows attackers to replace files on the appliance via crafted email attachments — potentially adding root users, altering configuration, executing arbitrary code, or causing permanent DoS. The fix is provided in Content Scanner Tools 23.3.0.4823 and later (included in AsyncOS 15.5.1-055+); affected appliances with file analysis or content filters enabled should be updated and customers should contact TAC for recovery of impacted devices. No public exploits or active exploitation have been observed.