CVE-2025-20258: Cisco Duo command injection
This Cisco advisory covers CVE-2025-20258 in Duo.
- CVE-2025-20258
Key facts
- Vendor rating
- Medium, CVSS 5.4
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N· base score 5.4, scored by ciscoAttack vector: network. Attack complexity: low. Privileges required: none. User interaction: required. Scope: unchanged. Confidentiality impact: low. Integrity impact: low. Availability impact: none.- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CISA SSVC
- Exploitation: none observed. Automatable: no. Technical impact: total. CISA, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Scope: This vulnerability affects the Cisco Duo self-service portal, which is cloud based.
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
An unauthenticated remote attacker could exploit a flaw in the self-service portal of Cisco Duo to inject arbitrary commands into emails that are sent by the service. The flaw is caused by insufficient input validation.
Text from the source record.
- Scope: This vulnerability affects the Cisco Duo self-service portal, which is cloud based.
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2025-20258
Workaround status
- There are no workarounds that address this vulnerability.
More Cisco advisories
CVE-2026-76506Nov 4, 2026Cisco UCS Central Software Remote Code Execution VulnerabilityCVE-2026-20241Nov 4, 2026Cisco Identity Services Engine Authorization Bypass VulnerabilityCVE-2026-76419Nov 4, 2026Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCVE-2026-76418Oct 28, 2026Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseCVE-2026-20241Oct 28, 2026Cisco Advance Notification for Publication of November 4, 2026, Security AdvisoriesCVE-2026-105482Oct 27, 2026Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
Get an email when Cisco publishes the next one.
See Cisco's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
