SB2025052217 - Multiple vulnerabilities in Cisco Secure Network Analytics Manager and Secure Network Analytics Virtual Manager

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2025-20256)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to insufficient input validation in specific fields of the web-based management interface. A remote administrator can execute arbitrary commands on the underlying operating system.

2) Incorrect authorization (CVE-ID: CVE-2025-20257)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to insufficient authorization enforcement in an API subsystem. A remote user can obfuscate legitimate findings in analytics reports or create false indications with alarms and alerts on the target device.

Remediation

Install update from vendor's website.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-ssti-dPuLqSmZ
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-apiacv-4B6X5ysw