Cisco Duo
Recent Cisco Duo Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2024-03-06 | Cisco Duo Authentication for Windows Logon and RDP Authentication Bypass Vulnerability | March 6, 2024 |
| 2024-03-06 | Cisco Duo Authentication for Windows Logon and RDP Information Disclosure Vulnerability | March 6, 2024 |
| 2023-08-16 | Cisco Duo Device Health Application for Windows Arbitrary File Write Vulnerability | August 16, 2023 |
| 2023-07-07 | Cisco Duo Authentication Proxy Information Disclosure Vulnerability | July 7, 2023 |
| 2023-06-21 | Cisco Duo Two-Factor Authentication for macOS Authentication Bypass Vulnerability | June 21, 2023 |
| 2023-04-05 | Cisco Duo Authentication for macOS and Duo Authentication for Windows Logon Offline Credentials Replay Vulnerability | April 5, 2023 |
| 2022-09-28 | Cisco Duo for macOS Authentication Bypass Vulnerability | September 28, 2022 |
By the Year
In 2024 there have been 0 vulnerabilities in Cisco Duo . Last year Duo had 2 security vulnerabilities published. Right now, Duo is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 2 | 5.60 |
| 2022 | 1 | 6.80 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Duo vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Cisco Duo Security Vulnerabilities
A vulnerability in Cisco Duo Two-Factor Authentication for macOS could
CVE-2023-20199
6.6 - Medium
- June 28, 2023
A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This vulnerability is due to the incorrect handling of responses from Cisco Duo when the application is configured to fail open. An attacker with primary user credentials could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the affected device without valid permission.
A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could
CVE-2023-20123
4.6 - Medium
- April 05, 2023
A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gain unauthorized access to an affected macOS or Windows device. This vulnerability exists because session credentials do not properly expire. An attacker could exploit this vulnerability by replaying previously used multifactor authentication (MFA) codes to bypass MFA protection. A successful exploit could allow the attacker to gain unauthorized access to the affected device.
Authentication Bypass by Capture-replay
A vulnerability in the smart card login authentication of Cisco Duo for macOS could
CVE-2022-20662
6.8 - Medium
- September 30, 2022
A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability exists because the assigned user of a smart card is not properly matched with the authenticating user. An attacker could exploit this vulnerability by configuring a smart card login to bypass Duo authentication. A successful exploit could allow the attacker to use any personal identity verification (PIV) smart card for authentication, even if the smart card is not assigned to the authenticating user.
authentification
