CVE-2025-20345: Cisco Duo Authentication Proxy Info Leak

CVE-2025-20345 Overview

Cisco disclosed CVE-2025-20345, an information disclosure vulnerability in the debug logging function of Cisco Duo Authentication Proxy. The flaw stems from insufficient masking of sensitive information before it is written to system log files [CWE-200]. An authenticated, high-privileged, remote attacker who can access logs on an affected system can view sensitive data that should be restricted.

The vulnerability requires high privileges and no user interaction. Exploitation impacts confidentiality only, without affecting integrity or availability. No public exploit code and no exploitation in the wild have been reported.

Critical Impact
A high-privileged remote attacker with access to Duo Authentication Proxy log files can read sensitive information exposed by the debug logging function.

Affected Products

Cisco Duo Authentication Proxy (debug logging function)
Refer to the Cisco Security Advisory for Auth Proxy Log for the definitive fixed-release matrix
Cisco tracking references include the Cisco ERP Alert ERP-66682

Discovery Timeline

2025-08-20 - CVE-2025-20345 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20345

Vulnerability Analysis

Cisco Duo Authentication Proxy acts as an on-premises component that brokers authentication between enterprise applications (VPN, RADIUS, LDAP clients) and the Duo cloud service. The proxy processes authentication payloads that can include usernames, tokens, and secondary factor material.

When debug logging is enabled, the proxy writes runtime diagnostics to system log files. CVE-2025-20345 arises because the debug logging routine does not sufficiently mask sensitive fields before they are persisted to disk. Sensitive material intended to be redacted appears in cleartext or partially cleartext form inside the log records.

Exploitation is restricted to attackers who already hold high privileges on the host and can reach the log storage over the network. The impact is limited to information disclosure; the attacker cannot modify data or degrade service availability through this issue alone. However, the disclosed material can support follow-on attacks against downstream identity systems.

Root Cause

The root cause is insufficient output sanitization in the debug logging path [CWE-200]. Fields that should be masked or omitted from log records are serialized in full when the proxy runs at a verbose logging level. The defect is a missing or incomplete redaction step rather than a memory-safety or access-control failure.

Attack Vector

The attack vector is network-based against the log store on the proxy host. An authenticated administrator or an attacker who has compromised a high-privileged account reads the log files produced by the Duo Authentication Proxy. No user interaction is required, and no additional exploitation primitive is needed once log access is obtained.

Because exploitation reduces to file read operations, there is no distinctive exploit payload. The vulnerability manifests passively whenever debug logging is active and sensitive authentication traffic is processed. See the Cisco advisory for technical details.

Detection Methods for CVE-2025-20345

Indicators of Compromise

Presence of Duo Authentication Proxy debug log entries containing unmasked authentication fields, tokens, or credential material.
Access to Duo Authentication Proxy log directories (for example authproxy.log) by accounts that do not normally administer the proxy.
Copying, archiving, or exfiltration of proxy log files to unusual destinations or removable media.

Detection Strategies

Audit Duo Authentication Proxy configuration for debug=true or elevated log verbosity in authproxy.cfg and flag any host running verbose logging in production.
Correlate file read events on proxy log paths with the identity performing the read to detect anomalous access by high-privileged accounts.
Scan existing log files for regex patterns matching credential-like tokens to identify historical exposure prior to patching.

Monitoring Recommendations

Forward Duo Authentication Proxy host logs and file-access audit events to a centralized SIEM for retention and correlation.
Alert on interactive logons and privilege elevations on Duo proxy hosts, since exploitation requires high privileges.
Monitor outbound network flows from proxy hosts for transfers of large log archives.

How to Mitigate CVE-2025-20345

Immediate Actions Required

Apply the fixed Cisco Duo Authentication Proxy release listed in the Cisco Security Advisory cisco-sa-authproxlog-SxczXQ63.
Disable debug logging on production Duo Authentication Proxy instances until the patch is deployed.
Rotate any credentials, tokens, or shared secrets that may have been written to debug logs while the vulnerable version was running.
Restrict filesystem and network access to log directories to the minimum set of administrative accounts.

Patch Information

Cisco has published a fixed software release through the Cisco Security Advisory for Auth Proxy Log. Administrators should consult the advisory for the specific fixed version matching their deployed release train and follow Cisco's standard upgrade procedure for the Duo Authentication Proxy service. Additional tracking is available via the Cisco ERP Alert ERP-66682.

Workarounds

Set the Duo Authentication Proxy log level to the default (non-debug) value in authproxy.cfg and restart the service.
Purge or securely delete existing debug log files that were produced by vulnerable versions, after preserving forensic copies if required.
Enforce least-privilege access controls on the proxy host so that only designated administrators can read the log directory.

bash

# Configuration example: disable debug logging in authproxy.cfg
# Edit the [main] section on the Duo Authentication Proxy host
[main]
debug=false

# Restart the service after saving the configuration
# Linux
sudo systemctl restart duoauthproxy

# Windows (elevated PowerShell)
Restart-Service DuoAuthProxy