cvelistv5 - cve-2025-20139

CVE-2025-20139 (GCVE-0-2025-20139)

Vulnerability from cvelistv5 – Published: 2025-04-02 16:16 – Updated: 2025-04-02 16:33

Summary

A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-185 - Incorrect Regular Expression

Assigner

cisco

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Enterprise Chat and Email	Affected: 11.5(1) Affected: 11.6(1) Affected: 11.6(1)_ES2 Affected: 11.6(1)_ES3 Affected: 11.6(1)_ES4 Affected: 11.6(1)_ES5 Affected: 11.6(1)_ES6 Affected: 11.6(1)_ES10 Affected: 11.6(1)_ES11 Affected: 11.6(1)_ES7 Affected: 11.6(1)_ES8 Affected: 11.6(1)_ES9 Affected: 11.6(1)_ES9a Affected: 11.6(1)_ES12 Affected: 11.6(1)_ES12_ET1 Affected: 12.0(1) Affected: 12.0(1)_ES1 Affected: 12.0(1)_ES2 Affected: 12.0(1)_ES3 Affected: 12.0(1)_ES4 Affected: 12.0(1)_ES5 Affected: 12.0(1)_ES5a Affected: 12.0(1)_ES6 Affected: 12.0(1)_ES6_ET1 Affected: 12.0(1)_ES6_ET2 Affected: 12.0(1)_ES6_ET3 Affected: 12.0(1)_ES7 Affected: 12.0(1)_ES7_ET1 Affected: 12.5(1) Affected: 12.5(1)_ES1 Affected: 12.5(1)_ES2 Affected: 12.5(1)_ES3 Affected: 12.5(1)_ES3_ET1 Affected: 12.5(1)_ET1 Affected: 12.5(1)_ES4 Affected: 12.5(1)_ES3_ET2 Affected: 12.5(1)_ES4_ET1 Affected: 12.5(1)_ES5 Affected: 12.5(1)_ES5_ET1 Affected: 12.5(1)_ES6 Affected: 12.5(1)_ES7 Affected: 12.5(1)_ES8 Affected: 12.5(1)_ES8_ET1 Affected: 12.5(1)_ES3_ET3 Affected: 12.5(1)_ES5_ET2 Affected: 12.5(1)_ES6_ET1 Affected: 12.5(1)_ES4_ET2 Affected: 12.5(1)_ES7_ET1 Affected: 12.5(1)_ES9 Affected: 12.6(1) Affected: 12.6(1)_ET1 Affected: 12.6(1)_ET2 Affected: 12.6(1)_ES1 Affected: 12.6(1)_ET3 Affected: 12.6(1)_ES1_ET1 Affected: 12.6(1)_ES2 Affected: 12.6(1)_ES3 Affected: 12.6(1)_ES4 Affected: 12.6(1)_ES4_ET1 Affected: 12.6(1)_ES5 Affected: 12.6(1)_ES5_ET1 Affected: 12.6(1)_ES5_ET2 Affected: 12.6(1)_ES6 Affected: 12.6(1)_ES6_ET1 Affected: 12.6(1)_ES6_ET2 Affected: 12.6(1)_ES7 Affected: 12.6(1)_ES8 Affected: 12.6(1)_ES4_ET2 Affected: 12.6(1)_ES3_ET3 Affected: 12.6(1)_ES2_ET5 Affected: 12.6(1)_ES1_ET2 Affected: 12.6(1)_ES8_ET1 Affected: 12.6(1)_ES7_ET1 Affected: 12.6(1)_ES6_ET3 Affected: 12.6(1)_ES5_ET3 Affected: 12.6(1)_ES8_ET2 Affected: 12.6(1)_ES9 Affected: 12.6(1)_ES9_ET1 Affected: 12.6(1)_ES9_ET2 Affected: 12.6(1)_ES9_ET3 Affected: 12.6_ES2_ET1 Affected: 12.6_ES2_ET2 Affected: 12.6_ES2_ET3 Affected: 12.6_ES2_ET4 Affected: 12.6_ES3_ET1 Affected: 12.6_ES3_ET2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T16:33:38.164036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-02T16:33:45.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Enterprise Chat and Email",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "11.5(1)"
            },
            {
              "status": "affected",
              "version": "11.6(1)"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES2"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES3"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES4"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES5"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES6"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES10"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES11"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES7"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES8"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES9"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES9a"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES12"
            },
            {
              "status": "affected",
              "version": "11.6(1)_ES12_ET1"
            },
            {
              "status": "affected",
              "version": "12.0(1)"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES1"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES2"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES3"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES4"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES5"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES5a"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES6"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES6_ET1"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES6_ET2"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES6_ET3"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES7"
            },
            {
              "status": "affected",
              "version": "12.0(1)_ES7_ET1"
            },
            {
              "status": "affected",
              "version": "12.5(1)"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES1"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES2"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES3"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES3_ET1"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ET1"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES4"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES3_ET2"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES4_ET1"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES5"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES5_ET1"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES6"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES7"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES8"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES8_ET1"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES3_ET3"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES5_ET2"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES6_ET1"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES4_ET2"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES7_ET1"
            },
            {
              "status": "affected",
              "version": "12.5(1)_ES9"
            },
            {
              "status": "affected",
              "version": "12.6(1)"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ET1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ET2"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ET3"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES1_ET1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES2"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES3"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES4"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES4_ET1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES5"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES5_ET1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES5_ET2"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES6"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES6_ET1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES6_ET2"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES7"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES8"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES4_ET2"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES3_ET3"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES2_ET5"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES1_ET2"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES8_ET1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES7_ET1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES6_ET3"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES5_ET3"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES8_ET2"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES9"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES9_ET1"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES9_ET2"
            },
            {
              "status": "affected",
              "version": "12.6(1)_ES9_ET3"
            },
            {
              "status": "affected",
              "version": "12.6_ES2_ET1"
            },
            {
              "status": "affected",
              "version": "12.6_ES2_ET2"
            },
            {
              "status": "affected",
              "version": "12.6_ES2_ET3"
            },
            {
              "status": "affected",
              "version": "12.6_ES2_ET4"
            },
            {
              "status": "affected",
              "version": "12.6_ES3_ET1"
            },
            {
              "status": "affected",
              "version": "12.6_ES3_ET2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.\r\n\r This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-185",
              "description": "Incorrect Regular Expression",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-02T16:16:17.546Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ece-dos-tC6m9GZ8",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ece-dos-tC6m9GZ8",
        "defects": [
          "CSCwm08282"
        ],
        "discovery": "EXTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20139",
    "datePublished": "2025-04-02T16:16:17.546Z",
    "dateReserved": "2024-10-10T19:15:13.213Z",
    "dateUpdated": "2025-04-02T16:33:45.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-20139\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2025-04-02T17:15:43.097\",\"lastModified\":\"2025-08-06T20:03:54.360\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.\\r\\n\\r This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en las funciones de mensajer\u00eda de chat de Cisco Enterprise Chat and Email (ECE) podr\u00eda permitir que un atacante remoto no autenticado provoque una denegaci\u00f3n de servicio (DoS). Esta vulnerabilidad se debe a una validaci\u00f3n incorrecta de la informaci\u00f3n proporcionada por el usuario en los puntos de entrada del chat. Un atacante podr\u00eda explotar esta vulnerabilidad enviando solicitudes maliciosas a un punto de entrada del chat de la aplicaci\u00f3n afectada. Si se explota con \u00e9xito, el atacante podr\u00eda provocar que la aplicaci\u00f3n deje de responder, lo que provocar\u00eda una denegaci\u00f3n de servicio (DoS). Es posible que la aplicaci\u00f3n no se recupere por s\u00ed sola y que un administrador deba reiniciar los servicios manualmente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-185\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.6\\\\(1\\\\)es10\",\"matchCriteriaId\":\"2018F275-5BB3-4251-B8A4-8BEB11958C0B\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20139\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-02T16:33:38.164036Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-02T16:33:41.310Z\"}}], \"cna\": {\"source\": {\"defects\": [\"CSCwm08282\"], \"advisory\": \"cisco-sa-ece-dos-tC6m9GZ8\", \"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Enterprise Chat and Email\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.5(1)\"}, {\"status\": \"affected\", \"version\": \"11.6(1)\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES2\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES3\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES4\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES5\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES6\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES10\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES11\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES7\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES8\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES9\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES9a\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES12\"}, {\"status\": \"affected\", \"version\": \"11.6(1)_ES12_ET1\"}, {\"status\": \"affected\", \"version\": \"12.0(1)\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES1\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES2\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES3\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES4\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES5\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES5a\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES6\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES6_ET1\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES6_ET2\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES6_ET3\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES7\"}, {\"status\": \"affected\", \"version\": \"12.0(1)_ES7_ET1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES2\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES3\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES3_ET1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ET1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES4\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES3_ET2\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES4_ET1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES5\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES5_ET1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES6\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES7\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES8\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES8_ET1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES3_ET3\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES5_ET2\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES6_ET1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES4_ET2\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES7_ET1\"}, {\"status\": \"affected\", \"version\": \"12.5(1)_ES9\"}, {\"status\": \"affected\", \"version\": \"12.6(1)\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ET2\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ET3\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES1_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES2\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES3\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES4\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES4_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES5\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES5_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES5_ET2\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES6\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES6_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES6_ET2\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES7\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES8\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES4_ET2\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES3_ET3\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES2_ET5\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES1_ET2\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES8_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES7_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES6_ET3\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES5_ET3\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES8_ET2\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES9\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES9_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES9_ET2\"}, {\"status\": \"affected\", \"version\": \"12.6(1)_ES9_ET3\"}, {\"status\": \"affected\", \"version\": \"12.6_ES2_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6_ES2_ET2\"}, {\"status\": \"affected\", \"version\": \"12.6_ES2_ET3\"}, {\"status\": \"affected\", \"version\": \"12.6_ES2_ET4\"}, {\"status\": \"affected\", \"version\": \"12.6_ES3_ET1\"}, {\"status\": \"affected\", \"version\": \"12.6_ES3_ET2\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8\", \"name\": \"cisco-sa-ece-dos-tC6m9GZ8\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.\\r\\n\\r This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-185\", \"description\": \"Incorrect Regular Expression\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2025-04-02T16:16:17.546Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-20139\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-02T16:33:45.699Z\", \"dateReserved\": \"2024-10-10T19:15:13.213Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2025-04-02T16:16:17.546Z\", \"assignerShortName\": \"cisco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-RX2W-X63R-4R67

Vulnerability from github – Published: 2025-04-02 18:30 – Updated: 2025-04-02 18:30

Details

A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-20139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-185"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-02T17:15:43Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.\n\n This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.",
  "id": "GHSA-rx2w-x63r-4r67",
  "modified": "2025-04-02T18:30:53Z",
  "published": "2025-04-02T18:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20139"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2025-0104

Vulnerability from csaf_ncscnl - Published: 2025-04-03 08:04 - Updated: 2025-04-03 08:04

Summary

Kwetsbaarheid verholpen in Cisco Enterprise Chat and Email

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Cisco heeft een kwetsbaarheid verholpen in Cisco Enterprise Chat and Email (ECE).

Interpretaties

De kwetsbaarheid bevindt zich in de wijze waarop Cisco Enterprise Chat and Email (ECE) onjuiste invoer valideert in zijn chatfunctionaliteiten. Dit kan leiden tot een Denial-of-Service (DoS) situatie, wat mogelijk handmatige interventie vereist om de normale werking te herstellen. Ongeauthenticeerde externe aanvallers kunnen deze kwetsbaarheid misbruiken.

Oplossingen

Cisco heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

medium

CWE-185

Incorrect Regular Expression

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Cisco heeft een kwetsbaarheid verholpen in Cisco Enterprise Chat and Email (ECE).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid bevindt zich in de wijze waarop Cisco Enterprise Chat and Email (ECE) onjuiste invoer valideert in zijn chatfunctionaliteiten. Dit kan leiden tot een Denial-of-Service (DoS) situatie, wat mogelijk handmatige interventie vereist om de normale werking te herstellen. Ongeauthenticeerde externe aanvallers kunnen deze kwetsbaarheid misbruiken.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Cisco heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Incorrect Regular Expression",
        "title": "CWE-185"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - cisco",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8"
      },
      {
        "category": "external",
        "summary": "Source raw - cisco",
        "url": "https://sec.cloudapps.cisco.com/security/center/publicationService.x?limit=20"
      }
    ],
    "title": "Kwetsbaarheid verholpen in Cisco Enterprise Chat and Email",
    "tracking": {
      "current_release_date": "2025-04-03T08:04:22.928655Z",
      "generator": {
        "date": "2025-02-25T15:15:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.0"
        }
      },
      "id": "NCSC-2025-0104",
      "initial_release_date": "2025-04-03T08:04:22.928655Z",
      "revision_history": [
        {
          "date": "2025-04-03T08:04:22.928655Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.5(1)",
                "product": {
                  "name": "vers:unknown/11.5(1)",
                  "product_id": "CSAFPID-1320657"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)",
                "product": {
                  "name": "vers:unknown/11.6(1)",
                  "product_id": "CSAFPID-1320662"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es10",
                "product": {
                  "name": "vers:unknown/11.6(1)_es10",
                  "product_id": "CSAFPID-1320652"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es11",
                "product": {
                  "name": "vers:unknown/11.6(1)_es11",
                  "product_id": "CSAFPID-1320647"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es12",
                "product": {
                  "name": "vers:unknown/11.6(1)_es12",
                  "product_id": "CSAFPID-2598554"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es12_et1",
                "product": {
                  "name": "vers:unknown/11.6(1)_es12_et1",
                  "product_id": "CSAFPID-2598555"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es2",
                "product": {
                  "name": "vers:unknown/11.6(1)_es2",
                  "product_id": "CSAFPID-1320650"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es3",
                "product": {
                  "name": "vers:unknown/11.6(1)_es3",
                  "product_id": "CSAFPID-1320634"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es4",
                "product": {
                  "name": "vers:unknown/11.6(1)_es4",
                  "product_id": "CSAFPID-1320635"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es5",
                "product": {
                  "name": "vers:unknown/11.6(1)_es5",
                  "product_id": "CSAFPID-1320642"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es6",
                "product": {
                  "name": "vers:unknown/11.6(1)_es6",
                  "product_id": "CSAFPID-1320641"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es7",
                "product": {
                  "name": "vers:unknown/11.6(1)_es7",
                  "product_id": "CSAFPID-1320659"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es8",
                "product": {
                  "name": "vers:unknown/11.6(1)_es8",
                  "product_id": "CSAFPID-1320637"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es9",
                "product": {
                  "name": "vers:unknown/11.6(1)_es9",
                  "product_id": "CSAFPID-1320639"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/11.6(1)_es9a",
                "product": {
                  "name": "vers:unknown/11.6(1)_es9a",
                  "product_id": "CSAFPID-1320651"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)",
                "product": {
                  "name": "vers:unknown/12.0(1)",
                  "product_id": "CSAFPID-1320654"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es1",
                "product": {
                  "name": "vers:unknown/12.0(1)_es1",
                  "product_id": "CSAFPID-1320653"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es2",
                "product": {
                  "name": "vers:unknown/12.0(1)_es2",
                  "product_id": "CSAFPID-1320658"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es3",
                "product": {
                  "name": "vers:unknown/12.0(1)_es3",
                  "product_id": "CSAFPID-1320646"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es4",
                "product": {
                  "name": "vers:unknown/12.0(1)_es4",
                  "product_id": "CSAFPID-1320648"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es5",
                "product": {
                  "name": "vers:unknown/12.0(1)_es5",
                  "product_id": "CSAFPID-1320649"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es5a",
                "product": {
                  "name": "vers:unknown/12.0(1)_es5a",
                  "product_id": "CSAFPID-1320638"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es6",
                "product": {
                  "name": "vers:unknown/12.0(1)_es6",
                  "product_id": "CSAFPID-1320636"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es6_et1",
                "product": {
                  "name": "vers:unknown/12.0(1)_es6_et1",
                  "product_id": "CSAFPID-1320640"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/12.0(1)_es6_et2",
                "product": {
                  "name": "vers:unknown/12.0(1)_es6_et2",
                  "product_id": "CSAFPID-2598556"
                }
              }
            ],
            "category": "product_name",
            "name": "Cisco Enterprise Chat and Email"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-20139",
      "cwe": {
        "id": "CWE-185",
        "name": "Incorrect Regular Expression"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Regular Expression",
          "title": "CWE-185"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1320657",
          "CSAFPID-1320662",
          "CSAFPID-1320652",
          "CSAFPID-1320647",
          "CSAFPID-2598554",
          "CSAFPID-2598555",
          "CSAFPID-1320650",
          "CSAFPID-1320634",
          "CSAFPID-1320635",
          "CSAFPID-1320642",
          "CSAFPID-1320641",
          "CSAFPID-1320659",
          "CSAFPID-1320637",
          "CSAFPID-1320639",
          "CSAFPID-1320651",
          "CSAFPID-1320654",
          "CSAFPID-1320653",
          "CSAFPID-1320658",
          "CSAFPID-1320646",
          "CSAFPID-1320648",
          "CSAFPID-1320649",
          "CSAFPID-1320638",
          "CSAFPID-1320636",
          "CSAFPID-1320640",
          "CSAFPID-2598556"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-20139",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20139.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1320657",
            "CSAFPID-1320662",
            "CSAFPID-1320652",
            "CSAFPID-1320647",
            "CSAFPID-2598554",
            "CSAFPID-2598555",
            "CSAFPID-1320650",
            "CSAFPID-1320634",
            "CSAFPID-1320635",
            "CSAFPID-1320642",
            "CSAFPID-1320641",
            "CSAFPID-1320659",
            "CSAFPID-1320637",
            "CSAFPID-1320639",
            "CSAFPID-1320651",
            "CSAFPID-1320654",
            "CSAFPID-1320653",
            "CSAFPID-1320658",
            "CSAFPID-1320646",
            "CSAFPID-1320648",
            "CSAFPID-1320649",
            "CSAFPID-1320638",
            "CSAFPID-1320636",
            "CSAFPID-1320640",
            "CSAFPID-2598556"
          ]
        }
      ],
      "title": "CVE-2025-20139"
    }
  ]
}

FKIE_CVE-2025-20139

Vulnerability from fkie_nvd - Published: 2025-04-02 17:15 - Updated: 2025-08-06 20:03

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8	Vendor Advisory

Impacted products

	Vendor	Product	Version
	cisco	enterprise_chat_and_email	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2018F275-5BB3-4251-B8A4-8BEB11958C0B",
              "versionEndExcluding": "12.6\\(1\\)es10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.\r\n\r This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en las funciones de mensajer\u00eda de chat de Cisco Enterprise Chat and Email (ECE) podr\u00eda permitir que un atacante remoto no autenticado provoque una denegaci\u00f3n de servicio (DoS). Esta vulnerabilidad se debe a una validaci\u00f3n incorrecta de la informaci\u00f3n proporcionada por el usuario en los puntos de entrada del chat. Un atacante podr\u00eda explotar esta vulnerabilidad enviando solicitudes maliciosas a un punto de entrada del chat de la aplicaci\u00f3n afectada. Si se explota con \u00e9xito, el atacante podr\u00eda provocar que la aplicaci\u00f3n deje de responder, lo que provocar\u00eda una denegaci\u00f3n de servicio (DoS). Es posible que la aplicaci\u00f3n no se recupere por s\u00ed sola y que un administrador deba reiniciar los servicios manualmente."
    }
  ],
  "id": "CVE-2025-20139",
  "lastModified": "2025-08-06T20:03:54.360",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "psirt@cisco.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-02T17:15:43.097",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-185"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Primary"
    }
  ]
}

CERTFR-2025-AVI-0270

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Cisco	Meraki MX	Meraki MX microgiciel versions 19.1.x antérieures à 19.1.4
Cisco	Meraki MX	Meraki MX microgiciel versions antérieures à 18.107.12
Cisco	Meraki MX	Meraki MX microgiciel versions 18.2.x antérieures à 18.211.4
Cisco	Enterprise Chat and Email (ECE)	Enterprise Chat and Email versions antérieures à 12.6 ES 10

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-ece-dos-tC6m9GZ8	2025-04-02	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-meraki-mx-vpn-dos-vNRpDvfb	2025-04-02	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Meraki MX microgiciel versions 19.1.x ant\u00e9rieures \u00e0 19.1.4",
      "product": {
        "name": "Meraki MX",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Meraki MX microgiciel versions ant\u00e9rieures \u00e0 18.107.12",
      "product": {
        "name": "Meraki MX",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Meraki MX microgiciel versions 18.2.x ant\u00e9rieures \u00e0 18.211.4",
      "product": {
        "name": "Meraki MX",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Enterprise Chat and Email versions ant\u00e9rieures \u00e0 12.6 ES 10",
      "product": {
        "name": "Enterprise Chat and Email (ECE)",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-20139",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20139"
    },
    {
      "name": "CVE-2025-20212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20212"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0270",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-04-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": "2025-04-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ece-dos-tC6m9GZ8",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8"
    },
    {
      "published_at": "2025-04-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-meraki-mx-vpn-dos-vNRpDvfb",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vNRpDvfb"
    }
  ]
}

CERTFR-2025-AVI-0270

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Cisco	Meraki MX	Meraki MX microgiciel versions 19.1.x antérieures à 19.1.4
Cisco	Meraki MX	Meraki MX microgiciel versions antérieures à 18.107.12
Cisco	Meraki MX	Meraki MX microgiciel versions 18.2.x antérieures à 18.211.4
Cisco	Enterprise Chat and Email (ECE)	Enterprise Chat and Email versions antérieures à 12.6 ES 10

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-ece-dos-tC6m9GZ8	2025-04-02	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-meraki-mx-vpn-dos-vNRpDvfb	2025-04-02	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Meraki MX microgiciel versions 19.1.x ant\u00e9rieures \u00e0 19.1.4",
      "product": {
        "name": "Meraki MX",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Meraki MX microgiciel versions ant\u00e9rieures \u00e0 18.107.12",
      "product": {
        "name": "Meraki MX",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Meraki MX microgiciel versions 18.2.x ant\u00e9rieures \u00e0 18.211.4",
      "product": {
        "name": "Meraki MX",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Enterprise Chat and Email versions ant\u00e9rieures \u00e0 12.6 ES 10",
      "product": {
        "name": "Enterprise Chat and Email (ECE)",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-20139",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20139"
    },
    {
      "name": "CVE-2025-20212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20212"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0270",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-04-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": "2025-04-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ece-dos-tC6m9GZ8",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8"
    },
    {
      "published_at": "2025-04-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-meraki-mx-vpn-dos-vNRpDvfb",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vNRpDvfb"
    }
  ]
}

CISCO-SA-ECE-DOS-TC6M9GZ8

Vulnerability from csaf_cisco - Published: 2025-04-02 16:00 - Updated: 2025-04-02 16:00

Summary

Cisco Enterprise Chat and Email Denial of Service Vulnerability

Notes

Summary

Vulnerable Products

This vulnerability affects Cisco ECE if the chat feature is enabled and an entry point has been configured. Cisco ECE is not affected in its default configuration. For information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory. Determine the Product Configuration To determine whether a Cisco ECE server has a chat entry point configured, connect to the System Console, choose Apps from the department-level Top Menu, and select Chat & Messaging > Entry Points. Check to see if there are any existing entry points, and if those entry points have been mapped and configured. If there are entry points that have been mapped and configured, the device is affected by this vulnerability.

Products Confirmed Not Vulnerable

Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.

Workarounds

There are no workarounds that address this vulnerability.

Fixed Software

Cisco has released free software updates ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#ssu"] that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html ["https://www.cisco.com/c/en/us/products/end-user-license-agreement.html"] Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page ["https://www.cisco.com/c/en/us/support/index.html"] on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page ["https://www.cisco.com/go/psirt"], to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"] Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Fixed Releases In the following table, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"] as indicated in this section. Cisco Enterprise Chat and Email Release First Fixed Release Earlier than 12.5 Migrate to a fixed release. 12.5 Migrate to a fixed release. 12.6 12.6 ES 10 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Vulnerability Policy

To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

This vulnerability was found during the resolution of a Cisco TAC support case.

Legal Disclaimer

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "summary": "This vulnerability was found during the resolution of a Cisco TAC support case."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.\r\n\r\nThis vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "This vulnerability affects Cisco ECE if the chat feature is enabled and an entry point has been configured.\r\n\r\nCisco ECE is not affected in its default configuration.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.\r\n\r\nDetermine the Product Configuration\r\n\r\nTo determine whether a Cisco ECE server has a chat entry point configured, connect to the System Console, choose Apps from the department-level Top Menu, and select Chat \u0026 Messaging \u003e Entry Points. Check to see if there are any existing entry points, and if those entry points have been mapped and configured. If there are entry points that have been mapped and configured, the device is affected by this vulnerability.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address this vulnerability.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco has released free software updates [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#ssu\"] that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels.\r\n\r\nCustomers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:\r\nhttps://www.cisco.com/c/en/us/products/end-user-license-agreement.html [\"https://www.cisco.com/c/en/us/products/end-user-license-agreement.html\"]\r\n\r\nAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.\r\n\r\nThe Cisco Support and Downloads page [\"https://www.cisco.com/c/en/us/support/index.html\"] on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\r\n  Customers Without Service Contracts\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]\r\n\r\nCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n      Fixed Releases\r\nIn the following table, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] as indicated in this section.\r\n        Cisco Enterprise Chat and Email Release  First Fixed Release          Earlier than 12.5  Migrate to a fixed release.      12.5  Migrate to a fixed release.      12.6  12.6 ES 10\r\nThe Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "This vulnerability was found during the resolution of a Cisco TAC support case.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco Enterprise Chat and Email Denial of Service Vulnerability",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "free software updates",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#ssu"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html",
        "url": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html"
      },
      {
        "category": "external",
        "summary": "Cisco Support and Downloads page",
        "url": "https://www.cisco.com/c/en/us/support/index.html"
      },
      {
        "category": "external",
        "summary": "considering software upgrades",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisories page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      }
    ],
    "title": "Cisco Enterprise Chat and Email Denial of Service Vulnerability",
    "tracking": {
      "current_release_date": "2025-04-02T16:00:00+00:00",
      "generator": {
        "date": "2025-04-02T15:58:18+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-ece-dos-tC6m9GZ8",
      "initial_release_date": "2025-04-02T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2025-04-02T15:57:59+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Enterprise Chat and Email",
            "product": {
              "name": "Cisco Enterprise Chat and Email ",
              "product_id": "CSAFPID-256410"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-20139",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwm08282"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-256410"
        ]
      },
      "release_date": "2025-04-02T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-256410"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-256410"
          ]
        }
      ],
      "title": "Cisco Enterprise Chat and Email Denial of Service Vulnerability"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-20139 (GCVE-0-2025-20139)

GHSA-RX2W-X63R-4R67

NCSC-2025-0104

FKIE_CVE-2025-20139

CERTFR-2025-AVI-0270

Solutions

CERTFR-2025-AVI-0270

Solutions

CISCO-SA-ECE-DOS-TC6M9GZ8

Tags

Sightings

Nomenclature