CVE-2025-20258 Command injection in Cisco Duo
Unauthenticated attackers can inject commands into emails sent by Cisco Duo, potentially delivering malicious content to users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-20258?
CVE-2025-20258 is a medium-severity command injection vulnerability in Cisco Duo, published on 21 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent by the service. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands into a portion of an email that is sent by the service. A successful exploit could allow the attacker to send emails that contain malicious content to unsuspecting users.
Weakness: CWE-77
Which versions are affected by CVE-2025-20258?
It affects 1 product.
Products include Cisco Duo.
How do I fix CVE-2025-20258?
No fix has been published for CVE-2025-20258 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-20258 being exploited?
There is no known exploitation of CVE-2025-20258 in the wild and no public exploit code.
Other vulnerabilities in Cisco Duo
Sources
Also known as GHSA-3c8c-p5w2-6pxx.