CVE-2025-20139
Estado: AnalizadaAlta (7.5)—
A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.65%
- Percentil entre todas las CVEs puntuadas: 50
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access85 % - Impacto principal
T1499.004Application or System Exploitationimpact90 %
AV:N/AC:L/PR:N sin UI permite ataque remoto sin autenticación a aplicación expuesta. Improper input validation causa DoS al detener la respuesta de servicios.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-185
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-20139",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-20139",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-02T16:33:38.164036Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Enterprise Chat and Email",
"versions": [
{
"status": "affected",
"version": "11.5(1)"
},
{
"status": "affected",
"version": "11.6(1)"
},
{
"status": "affected",
"version": "11.6(1)_ES2"
},
{
"status": "affected",
"version": "11.6(1)_ES3"
},
{
"status": "affected",
"version": "11.6(1)_ES4"
},
{
"status": "affected",
"version": "11.6(1)_ES5"
},
{
"status": "affected",
"version": "11.6(1)_ES6"
},
{
"status": "affected",
"version": "11.6(1)_ES10"
},
{
"status": "affected",
"version": "11.6(1)_ES11"
},
{
"status": "affected",
"version": "11.6(1)_ES7"
},
{
"status": "affected",
"version": "11.6(1)_ES8"
},
{
"status": "affected",
"version": "11.6(1)_ES9"
},
{
"status": "affected",
"version": "11.6(1)_ES9a"
},
{
"status": "affected",
"version": "11.6(1)_ES12"
},
{
"status": "affected",
"version": "11.6(1)_ES12_ET1"
},
{
"status": "affected",
"version": "12.0(1)"
},
{
"status": "affected",
"version": "12.0(1)_ES1"
},
{
"status": "affected",
"version": "12.0(1)_ES2"
},
{
"status": "affected",
"version": "12.0(1)_ES3"
},
{
"status": "affected",
"version": "12.0(1)_ES4"
},
{
"status": "affected",
"version": "12.0(1)_ES5"
},
{
"status": "affected",
"version": "12.0(1)_ES5a"
},
{
"status": "affected",
"version": "12.0(1)_ES6"
},
{
"status": "affected",
"version": "12.0(1)_ES6_ET1"
},
{
"status": "affected",
"version": "12.0(1)_ES6_ET2"
},
{
"status": "affected",
"version": "12.0(1)_ES6_ET3"
},
{
"status": "affected",
"version": "12.0(1)_ES7"
},
{
"status": "affected",
"version": "12.0(1)_ES7_ET1"
},
{
"status": "affected",
"version": "12.5(1)"
},
{
"status": "affected",
"version": "12.5(1)_ES1"
},
{
"status": "affected",
"version": "12.5(1)_ES2"
},
{
"status": "affected",
"version": "12.5(1)_ES3"
},
{
"status": "affected",
"version": "12.5(1)_ES3_ET1"
},
{
"status": "affected",
"version": "12.5(1)_ET1"
},
{
"status": "affected",
"version": "12.5(1)_ES4"
},
{
"status": "affected",
"version": "12.5(1)_ES3_ET2"
},
{
"status": "affected",
"version": "12.5(1)_ES4_ET1"
},
{
"status": "affected",
"version": "12.5(1)_ES5"
},
{
"status": "affected",
"version": "12.5(1)_ES5_ET1"
},
{
"status": "affected",
"version": "12.5(1)_ES6"
},
{
"status": "affected",
"version": "12.5(1)_ES7"
},
{
"status": "affected",
"version": "12.5(1)_ES8"
},
{
"status": "affected",
"version": "12.5(1)_ES8_ET1"
},
{
"status": "affected",
"version": "12.5(1)_ES3_ET3"
},
{
"status": "affected",
"version": "12.5(1)_ES5_ET2"
},
{
"status": "affected",
"version": "12.5(1)_ES6_ET1"
},
{
"status": "affected",
"version": "12.5(1)_ES4_ET2"
},
{
"status": "affected",
"version": "12.5(1)_ES7_ET1"
},
{
"status": "affected",
"version": "12.5(1)_ES9"
},
{
"status": "affected",
"version": "12.6(1)"
},
{
"status": "affected",
"version": "12.6(1)_ET1"
},
{
"status": "affected",
"version": "12.6(1)_ET2"
},
{
"status": "affected",
"version": "12.6(1)_ES1"
},
{
"status": "affected",
"version": "12.6(1)_ET3"
},
{
"status": "affected",
"version": "12.6(1)_ES1_ET1"
},
{
"status": "affected",
"version": "12.6(1)_ES2"
},
{
"status": "affected",
"version": "12.6(1)_ES3"
},
{
"status": "affected",
"version": "12.6(1)_ES4"
},
{
"status": "affected",
"version": "12.6(1)_ES4_ET1"
},
{
"status": "affected",
"version": "12.6(1)_ES5"
},
{
"status": "affected",
"version": "12.6(1)_ES5_ET1"
},
{
"status": "affected",
"version": "12.6(1)_ES5_ET2"
},
{
"status": "affected",
"version": "12.6(1)_ES6"
},
{
"status": "affected",
"version": "12.6(1)_ES6_ET1"
},
{
"status": "affected",
"version": "12.6(1)_ES6_ET2"
},
{
"status": "affected",
"version": "12.6(1)_ES7"
},
{
"status": "affected",
"version": "12.6(1)_ES8"
},
{
"status": "affected",
"version": "12.6(1)_ES4_ET2"
},
{
"status": "affected",
"version": "12.6(1)_ES3_ET3"
},
{
"status": "affected",
"version": "12.6(1)_ES2_ET5"
},
{
"status": "affected",
"version": "12.6(1)_ES1_ET2"
},
{
"status": "affected",
"version": "12.6(1)_ES8_ET1"
},
{
"status": "affected",
"version": "12.6(1)_ES7_ET1"
},
{
"status": "affected",
"version": "12.6(1)_ES6_ET3"
},
{
"status": "affected",
"version": "12.6(1)_ES5_ET3"
},
{
"status": "affected",
"version": "12.6(1)_ES8_ET2"
},
{
"status": "affected",
"version": "12.6(1)_ES9"
},
{
"status": "affected",
"version": "12.6(1)_ES9_ET1"
},
{
"status": "affected",
"version": "12.6(1)_ES9_ET2"
},
{
"status": "affected",
"version": "12.6(1)_ES9_ET3"
},
{
"status": "affected",
"version": "12.6_ES2_ET1"
},
{
"status": "affected",
"version": "12.6_ES2_ET2"
},
{
"status": "affected",
"version": "12.6_ES2_ET3"
},
{
"status": "affected",
"version": "12.6_ES2_ET4"
},
{
"status": "affected",
"version": "12.6_ES3_ET1"
},
{
"status": "affected",
"version": "12.6_ES3_ET2"
}
]
}
]
}
],
"published": "2025-04-02T17:15:43.097",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-tC6m9GZ8",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-185"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.\r\n\r This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover."
},
{
"lang": "es",
"value": "Una vulnerabilidad en las funciones de mensajería de chat de Cisco Enterprise Chat and Email (ECE) podría permitir que un atacante remoto no autenticado provoque una denegación de servicio (DoS). Esta vulnerabilidad se debe a una validación incorrecta de la información proporcionada por el usuario en los puntos de entrada del chat. Un atacante podría explotar esta vulnerabilidad enviando solicitudes maliciosas a un punto de entrada del chat de la aplicación afectada. Si se explota con éxito, el atacante podría provocar que la aplicación deje de responder, lo que provocaría una denegación de servicio (DoS). Es posible que la aplicación no se recupere por sí sola y que un administrador deba reiniciar los servicios manualmente."
}
],
"lastModified": "2026-06-17T08:40:45.613",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2018F275-5BB3-4251-B8A4-8BEB11958C0B",
"versionEndExcluding": "12.6\\(1\\)es10"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@cisco.com"
}