VDB
CVE-2025-20258
CVE-2025-20258
PUBLISHED
CVSS 5.400000095367432 MEDIUM
A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent by the service. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands into a portion of an email that is sent by the service. A successful exploit could allow the attacker to send emails that contain malicious content to unsuspecting users.
EPSS 0.07% · 21.0th percentile
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score
0.07%
21.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Duo | * |
| cisco | duo |
Exploit Intelligence
- cisco-sa-duo-ssp-cmd-inj-RCmYrNA (circl)
Timeline
- Oct 10, 2024 CVE ID Reserved
- May 21, 2025 CVE Published
- May 22, 2025 EPSS Score
- May 23, 2025 Coalition ESS Score
- Jun 2, 2025 EPSS Score
- Jun 13, 2025 EPSS Score
- Jun 24, 2025 EPSS Score
- Jul 6, 2025 EPSS Score
- Jul 17, 2025 EPSS Score
- Jul 23, 2025 Coalition ESS Score
- Jul 28, 2025 EPSS Score
- Aug 8, 2025 EPSS Score