Malicious email injection via insufficient input validation

Command injection in the Cisco Duo self-service portal allows remote attackers to place malicious content in service-generated emails. The cloud portal accepts attacker-controlled commands in part of an outbound email without sufficient input validation and embeds them in messages sent by the service. No authentication is required, but a recipient must interact with the malicious email; the result is content delivery rather than server-side code execution.