CVE-2025-20258

CVE-2025-20258 is a medium-severity vulnerability in the self-service portal of Cisco Duo, allowing an unauthenticated, remote attacker to inject arbitrary commands into emails sent by the service due to insufficient input validation. A successful exploit could enable the attacker to send malicious emails to users, potentially leading to information disclosure or integrity compromise. The vulnerability has a CVSS score of 5.4, indicating a network attack vector with low attack complexity and user interaction required. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.