Cisco Duo Authentication Proxy Information Disclosure Vulnerability

🚨SEVERITY: MEDIUM — CVSS 4.9Security Advisory

TL;DR 📌

  • A vulnerability in the debug logging function of Cisco Duo Authentication Proxy could allow an authenticated, high-privileged, remote attacker to view sensitive information in a system log file. This vulnerability is due to insufficient masking of sensitive information before it is written to system log files. An attacker could exploit this vulnerability by accessing logs…
  • Highest CVSS: 4.9 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20345.

What it is

CVE-2025-20345 sits in the debug logging function of Cisco Duo Authentication Proxy. When debug logging is enabled, the application writes sensitive information to system log files without adequately masking it first.

Exploitation requires an authenticated, high-privileged, remote attacker who already has access to read logs on the affected system — this is not an unauthenticated or pre-auth issue. Given that access, the attacker can view sensitive information in the log file that should have been restricted. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confirms the impact is confidentiality-only, with no effect on integrity or availability.

Cisco found this during internal security testing; there are no public reports of exploitation.

What to do

  • Upgrade Cisco Duo Authentication Proxy. Releases 6.5.1 and earlier should move to 6.5.2. Releases 5.8.2 and earlier have no direct fix and must migrate to a supported, fixed release line.
  • There is no workaround — patching is the only mitigation.
  • After upgrading, delete existing log files from the Duo Authentication Proxy host and from any other system where those logs may have been copied or forwarded. Debug logs generated before the fix may still contain the unmasked sensitive data.
  • Check the Duo Authentication Proxy reference documentation’s debug logging section to confirm where log files are stored on your systems before you go looking for copies to remove.
  • Review who has read access to logs on the Authentication Proxy host, since exploitation depends on an attacker already holding high-privilege access to that log data.

For leadership 🧭

Executive summary. Cisco Duo Authentication Proxy can write sensitive information to debug logs without proper masking, but only someone who already has high-privilege access to read those logs can exploit it. There is no exploitation reported and the fix is a straightforward upgrade, so this can be scheduled through normal patching rather than treated as an emergency.

Why it matters:

  • The flaw is confidentiality-only (no integrity or availability impact) but affects the Duo Authentication Proxy, a component that brokers authentication between your directory and Duo’s cloud service.
  • Exploitation requires an authenticated, high-privileged attacker with existing access to the log files on the Authentication Proxy host, meaning this raises the stakes of any account or system compromise on that host rather than being remotely exploitable on its own.
  • Log files generated before patching may already contain unmasked sensitive data, so upgrading alone does not remove exposure already sitting on disk or copied to log aggregation systems.
  • No workaround exists — versions 6.5.1 and earlier need 6.5.2, and 5.8.2 and earlier require migration to a fixed release line entirely.

Now / Next / Later:

  • Now: Identify all Cisco Duo Authentication Proxy instances in your environment and check their version against the fixed releases (6.5.2, or a current release line if running 5.8.2 or earlier).
  • Next: Upgrade affected Authentication Proxy installations to a fixed release in your next change window, then delete existing debug log files from the proxy host and any systems where those logs were forwarded or copied.
  • Later: Review and tighten who has read access to logs on the Authentication Proxy host, and confirm debug logging is only enabled when actively needed for troubleshooting rather than left on by default.

Source