Cisco Duo Network Gateway vulnerabilities

2 CVEs affecting Cisco Duo Network Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-3483, published 2020-10-14.

More from Cisco.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-7340, published 2019-04-17. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without…
• CVE-2020-3483, published 2020-10-14. Medium severity, CVSS 6.3. EPSS: 0.1% chance of exploitation in the next 30 days. Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted…