Read the docs
TI-2025-14478 Aliases CVE-2025-20178GHSA-vr9w-fp6c-vj58

Cisco Secure Network Analytics Privilege Escalation Vulnerability

Priority LOW 34CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-347.

Summary

A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerability is due to insufficient integrity checks within device backup files. An attacker with valid administrative credentials could exploit this vulnerability by crafting a malicious backup file and restoring it to an affected device. A successful exploit could allow the attacker to obtain shell access on the underlying operating system with the privileges of root.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Secure Network Analytics7.5.0; 7.5.1; 7.5.2—No fix listedCNA
  • Cisco Secure Network Analytics VendorCisco Affected 7.5.0; 7.5.1; 7.5.2 Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:-:*:*:*:*:*:*7.5.0VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-02-22:*:*:*:*:*:*7.5.0 rollup_2024-02-22VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-03-08:*:*:*:*:*:*7.5.0 rollup_2024-03-08VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-04-15:*:*:*:*:*:*7.5.0 rollup_2024-04-15VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-05-15:*:*:*:*:*:*7.5.0 rollup_2024-05-15VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-06-10:*:*:*:*:*:*7.5.0 rollup_2024-06-10VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-07-09:*:*:*:*:*:*7.5.0 rollup_2024-07-09VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-08-13:*:*:*:*:*:*7.5.0 rollup_2024-08-13VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-09-12:*:*:*:*:*:*7.5.0 rollup_2024-09-12VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-10-15:*:*:*:*:*:*7.5.0 rollup_2024-10-15VulnerableCisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:-:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-02-22:*:*:*:*:*:* Versions 7.5.0 rollup_2024-02-22 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-03-08:*:*:*:*:*:* Versions 7.5.0 rollup_2024-03-08 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-04-15:*:*:*:*:*:* Versions 7.5.0 rollup_2024-04-15 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-05-15:*:*:*:*:*:* Versions 7.5.0 rollup_2024-05-15 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-06-10:*:*:*:*:*:* Versions 7.5.0 rollup_2024-06-10 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-07-09:*:*:*:*:*:* Versions 7.5.0 rollup_2024-07-09 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-08-13:*:*:*:*:*:* Versions 7.5.0 rollup_2024-08-13 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-09-12:*:*:*:*:*:* Versions 7.5.0 rollup_2024-09-12 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-10-15:*:*:*:*:*:* Versions 7.5.0 rollup_2024-10-15 Vulnerable ·Cisco
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-12-02:*:*:*:*:*:*7.5.0 rollup_2024-12-02VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2025-01-24:*:*:*:*:*:*7.5.0 rollup_2025-01-24VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.1:-:*:*:*:*:*:*7.5.1VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-08-14:*:*:*:*:*:*7.5.1 rollup_2024-08-14VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-09-18:*:*:*:*:*:*7.5.1 rollup_2024-09-18VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-10-15:*:*:*:*:*:*7.5.1 rollup_2024-10-15VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-11-12:*:*:*:*:*:*7.5.1 rollup_2024-11-12VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2025-01-07:*:*:*:*:*:*7.5.1 rollup_2025-01-07VulnerableCisco
cpe:2.3:a:cisco:secure_network_analytics:7.5.2:-:*:*:*:*:*:*7.5.2VulnerableCisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-12-02:*:*:*:*:*:* Versions 7.5.0 rollup_2024-12-02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2025-01-24:*:*:*:*:*:* Versions 7.5.0 rollup_2025-01-24 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.1:-:*:*:*:*:*:* Versions 7.5.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-08-14:*:*:*:*:*:* Versions 7.5.1 rollup_2024-08-14 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-09-18:*:*:*:*:*:* Versions 7.5.1 rollup_2024-09-18 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-10-15:*:*:*:*:*:* Versions 7.5.1 rollup_2024-10-15 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-11-12:*:*:*:*:*:* Versions 7.5.1 rollup_2024-11-12 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2025-01-07:*:*:*:*:*:* Versions 7.5.1 rollup_2025-01-07 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_network_analytics:7.5.2:-:*:*:*:*:*:* Versions 7.5.2 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-20178
  2. 2026-10-03 Alias added: GHSA-vr9w-fp6c-vj58

References

Advisory 1

  • TI-2022-05356 Cisco Secure Network Analytics Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2023-06809 Cisco Secure Network Analytics Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-14554 Cisco Secure Network Analytics Manager Server-Side Template Injection Vulnerability CVSS 3.1HIGH 7.2
  • TI-2023-06810 Cisco Secure Network Analytics Remote Code Execution Vulnerability CVSS 3.1HIGH 7.2
  • TI-2025-14555 Cisco Secure Network Analytics API Authorization Vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2022-05222 Secure Network Analytics Cross-Site Scripting Vulnerability CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences