CVE-2020-3483

Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG host. Any private keys logged in this way could be viewed by those with access to the DNG host operating system without any need for reversing encrypted values or similar techniques. An attacker that gained access to the DNG logs and with the ability to intercept and manipulate network traffic between a user and the DNG, could decrypt and manipulate SSL/TLS connections to the DNG and to the protected applications behind it. Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7 are affected.

• CWE-256
• CWE-522

• https://duo.com/labs/psa/duo-psa-2020-004Patch, Vendor Advisory
• https://duo.com/labs/psa/duo-psa-2020-004Patch, Vendor Advisory

Published

Oct 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-3477A vulnerability in the CLI parser of Cisco IOS Software and …5.5
• CVE-2020-3478A vulnerability in the REST API of Cisco Enterprise NFV Infr…8.1
• CVE-2020-3479A vulnerability in the implementation of Multiprotocol Borde…7.5
• CVE-2020-3480Multiple vulnerabilities in the Zone-Based Firewall feature …8.6
• CVE-2020-3481A vulnerability in the EGG archive parsing module in Clam An…7.5
• CVE-2020-3482A vulnerability in the Traversal Using Relays around NAT (TU…6.5
• CVE-2020-3484A vulnerability in the web-based management interface of Cis…5.3
• CVE-2020-3485A vulnerability in the role-based access control (RBAC) func…6.3
• CVE-2020-3486Multiple vulnerabilities in the Control and Provisioning of …6.5
• CVE-2020-3487Multiple vulnerabilities in the Control and Provisioning of …6.5
• CVE-2020-3488Multiple vulnerabilities in the Control and Provisioning of …7.4
• CVE-2020-3489Multiple vulnerabilities in the Control and Provisioning of …7.4