Cisco ECE DoS via Chat Input Validation Failure
CVE-2025-20139 Published on April 2, 2025
A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.
Vulnerability Analysis
CVE-2025-20139 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Incorrect Regular Expression
The software specifies a regular expression in a way that causes data to be improperly matched or compared. When the regular expression is used in protection mechanisms such as filtering or validation, this may allow an attacker to bypass the intended restrictions on the incoming data.
Products Associated with CVE-2025-20139
Want to know whenever a new CVE is published for Cisco Enterprise Chat And Email? stack.watch will email you.
Affected Versions
Cisco Enterprise Chat and Email:- Version 11.5(1) is affected.
- Version 11.6(1) is affected.
- Version 11.6(1)_ES2 is affected.
- Version 11.6(1)_ES3 is affected.
- Version 11.6(1)_ES4 is affected.
- Version 11.6(1)_ES5 is affected.
- Version 11.6(1)_ES6 is affected.
- Version 11.6(1)_ES10 is affected.
- Version 11.6(1)_ES11 is affected.
- Version 11.6(1)_ES7 is affected.
- Version 11.6(1)_ES8 is affected.
- Version 11.6(1)_ES9 is affected.
- Version 11.6(1)_ES9a is affected.
- Version 11.6(1)_ES12 is affected.
- Version 11.6(1)_ES12_ET1 is affected.
- Version 12.0(1) is affected.
- Version 12.0(1)_ES1 is affected.
- Version 12.0(1)_ES2 is affected.
- Version 12.0(1)_ES3 is affected.
- Version 12.0(1)_ES4 is affected.
- Version 12.0(1)_ES5 is affected.
- Version 12.0(1)_ES5a is affected.
- Version 12.0(1)_ES6 is affected.
- Version 12.0(1)_ES6_ET1 is affected.
- Version 12.0(1)_ES6_ET2 is affected.
- Version 12.0(1)_ES6_ET3 is affected.
- Version 12.0(1)_ES7 is affected.
- Version 12.0(1)_ES7_ET1 is affected.
- Version 12.5(1) is affected.
- Version 12.5(1)_ES1 is affected.
- Version 12.5(1)_ES2 is affected.
- Version 12.5(1)_ES3 is affected.
- Version 12.5(1)_ES3_ET1 is affected.
- Version 12.5(1)_ET1 is affected.
- Version 12.5(1)_ES4 is affected.
- Version 12.5(1)_ES3_ET2 is affected.
- Version 12.5(1)_ES4_ET1 is affected.
- Version 12.5(1)_ES5 is affected.
- Version 12.5(1)_ES5_ET1 is affected.
- Version 12.5(1)_ES6 is affected.
- Version 12.5(1)_ES7 is affected.
- Version 12.5(1)_ES8 is affected.
- Version 12.5(1)_ES8_ET1 is affected.
- Version 12.5(1)_ES3_ET3 is affected.
- Version 12.5(1)_ES5_ET2 is affected.
- Version 12.5(1)_ES6_ET1 is affected.
- Version 12.5(1)_ES4_ET2 is affected.
- Version 12.5(1)_ES7_ET1 is affected.
- Version 12.5(1)_ES9 is affected.
- Version 12.6(1) is affected.
- Version 12.6(1)_ET1 is affected.
- Version 12.6(1)_ET2 is affected.
- Version 12.6(1)_ES1 is affected.
- Version 12.6(1)_ET3 is affected.
- Version 12.6(1)_ES1_ET1 is affected.
- Version 12.6(1)_ES2 is affected.
- Version 12.6(1)_ES3 is affected.
- Version 12.6(1)_ES4 is affected.
- Version 12.6(1)_ES4_ET1 is affected.
- Version 12.6(1)_ES5 is affected.
- Version 12.6(1)_ES5_ET1 is affected.
- Version 12.6(1)_ES5_ET2 is affected.
- Version 12.6(1)_ES6 is affected.
- Version 12.6(1)_ES6_ET1 is affected.
- Version 12.6(1)_ES6_ET2 is affected.
- Version 12.6(1)_ES7 is affected.
- Version 12.6(1)_ES8 is affected.
- Version 12.6(1)_ES4_ET2 is affected.
- Version 12.6(1)_ES3_ET3 is affected.
- Version 12.6(1)_ES2_ET5 is affected.
- Version 12.6(1)_ES1_ET2 is affected.
- Version 12.6(1)_ES8_ET1 is affected.
- Version 12.6(1)_ES7_ET1 is affected.
- Version 12.6(1)_ES6_ET3 is affected.
- Version 12.6(1)_ES5_ET3 is affected.
- Version 12.6(1)_ES8_ET2 is affected.
- Version 12.6(1)_ES9 is affected.
- Version 12.6(1)_ES9_ET1 is affected.
- Version 12.6(1)_ES9_ET2 is affected.
- Version 12.6(1)_ES9_ET3 is affected.
- Version 12.6_ES2_ET1 is affected.
- Version 12.6_ES2_ET2 is affected.
- Version 12.6_ES2_ET3 is affected.
- Version 12.6_ES2_ET4 is affected.
- Version 12.6_ES3_ET1 is affected.
- Version 12.6_ES3_ET2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.