Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2024-20401

A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device. Note: Manual intervention is required to recover from the DoS condition. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition.

CVSS 9.8 · CriticalBuzz score 24.1

Buzz score

Why this CVE is surfacing

Buzz score total 24.1

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 16.1 · diversity 8.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
16.1
4 evidence mentions in the snapshot
Diversity score
8.0
3 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
4 source links · newest first
  • Week in review: CrowdStrike update causes widespread IT outage, critical Splunk Enterprise flawHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Faulty CrowdStrike update takes out Windows machines worldwide Hundreds of thousands and possibly millions of Windows computers and servers worldwide have been made inoperable by a faulty update of Crowdstrike Falcon Sensors, and the outage affected transport, broadcast, financial, retail and other organizations in Europe, Australia, the US and elsewhere. Here’s what we know. Critical Splunk flaw can be exploited … More →

    newswww.helpnetsecurity.comJul 21, 2024, 8:00 AM
  • Cisco fixed a critical flaw in Security Email Gateway that could allow attackers to add root usersSecurity Affairs

    Cisco has addressed a critical vulnerability that could allow attackers to add new root users to Security Email Gateway (SEG) appliances. Cisco fixed a critical vulnerability, tracked as CVE-2024-20401 (CVSS score 9.8), that could allow unauthenticated, remote attackers to add new users with root privileges and permanently crash Security Email Gateway (SEG) appliances. The flaw […]

    newssecurityaffairs.comJul 19, 2024, 8:34 AM
  • Cisco Patches Critical Vulnerabilities in Secure Email Gateway, SSMSecurityWeek

    Cisco has released patches for critical vulnerabilities in Secure Email Gateway and Smart Software Manager On-Prem.

    newswww.securityweek.comJul 18, 2024, 10:53 AM
  • Cisco fixes critical flaws in Secure Email Gateway and SSM On-Prem (CVE-2024-20401, CVE-2024-20419)Help Net Security

    Cisco has fixed two critical vulnerabilities that may allow attackers to overwrite files on its Secure Email Gateways (CVE-2024-20401) and change the password of any user on its Smart Software Manager On-Prem license servers (CVE-2024-20419). Neither of the flaws are exploited in the wild, but both are remotely exploitable by unauthenticated attackers, so prompt action is advised. CVE-2024-20401 and CVE-2024-20419 Cisco Secure Email Gateways aim to protect businesses against emails laden with malware, malicious links … More →

    newswww.helpnetsecurity.comJul 18, 2024, 9:02 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-13346

    pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulne…

    CVSS 5.6 · Medium
    3 mentions
  • CVE-2026-13189

    In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side…

    CVSS 7.5 · High
    1 mention
  • CVE-2026-57211

    RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded b…

    CVSS 6.5 · Medium
    6 mentions
  • CVE-2026-15302

    The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for un…

    CVSS 5.3 · Medium
    2 mentions
  • CVE-2026-58300

    Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

    CVSS 6.2 · Medium
    2 mentions
  • CVE-2026-49290

    Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slo…

    CVSS 7.6 · High
    3 mentions