5.4 Medium

CVE-2025-20258 A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject…

Description

A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent by the service. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands into a portion of an email that is sent by the service. A successful exploit could allow the attacker to send emails that contain malicious content to unsuspecting users.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Cisco Duo	Versions not published

References

cisco-sa-duo-ssp-cmd-inj-RCmYrNA sec.cloudapps.cisco.com

Timeline

Published May 21, 2025
Last modified November 3, 2026

The 6 CVEs of Cisco Duo →

CVE-2024-20292 A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an… 4.4 Medium CVE-2024-20301 A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to… 6.2 Medium CVE-2023-20199 A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to… 6.2 Medium CVE-2023-20123 A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for… 6.3 Medium

Track this CVE