PT-2025-22380 · Cisco · Cisco Secure Network Analytics Manager+1

Sammy Tieng · Published 2025-05-21 · Updated 2025-05-22 · CVE-2025-20256

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This issue is due to insufficient input validation in specific fields of the web-based management interface. An attacker could exploit this by sending crafted input to an affected device, potentially allowing the execution of arbitrary commands on the underlying operating system with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2025-06740

CVE-2025-20256

Affected Products

Cisco Secure Network Analytics Manager

Cisco Secure Network Analytics Virtual Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-20256 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-ssti-dPuLqSmZ · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06740 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20256 · Vendor Advisory
• https://twitter.com/CVEnew/status/1925232472838541672 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925352987053973889 · Twitter Post