Cisco Secure Network Analytics Manager Server-Side Template Injection Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerability is due to insufficient input validation in specific fields of the web-based management interface. An attacker with valid administrative credentials could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Secure Network Analytics | 7.4.1; 7.4.2; 7.5.0; 7.5.1; 7.5.2 | — | No fix listed | CNA |
- Cisco Secure Network Analytics VendorCisco Affected 7.4.1; 7.4.2; 7.5.0; 7.5.1; 7.5.2 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:secure_network_analytics:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_network_analytics:7.4.2:*:*:*:*:*:*:* | 7.4.2 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_network_analytics:7.5.0:-:*:*:*:*:*:* | 7.5.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_network_analytics:7.5.1:-:*:*:*:*:*:* | 7.5.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_network_analytics:7.5.2:-:*:*:*:*:*:* | 7.5.2 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:secure_network_analytics:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_network_analytics:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_network_analytics:7.5.0:-:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_network_analytics:7.5.1:-:*:*:*:*:*:* Versions 7.5.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_network_analytics:7.5.2:-:*:*:*:*:*:* Versions 7.5.2 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-20256
- 2026-10-03 Alias added: GHSA-w687-qrqx-jr57
- 2026-11-03 EPSS moved to the 50th–90th percentile
References
Advisory 1
More Cisco Secure Network Analytics vulnerabilities
- TI-2022-05356 Cisco Secure Network Analytics Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.1
- TI-2023-06809 Cisco Secure Network Analytics Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
- TI-2025-14478 Cisco Secure Network Analytics Privilege Escalation Vulnerability CVSS 3.1HIGH 7.2
- TI-2023-06810 Cisco Secure Network Analytics Remote Code Execution Vulnerability CVSS 3.1HIGH 7.2
- TI-2025-14555 Cisco Secure Network Analytics API Authorization Vulnerability CVSS 3.1MEDIUM 6.5
- TI-2022-05222 Secure Network Analytics Cross-Site Scripting Vulnerability CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-20256 · CVE Program
- CVE-2025-20256 · NVD
- FIRST EPSS
- GHSA-w687-qrqx-jr57 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences