CVE-2025-20256
CVE-2025-20256 is a medium-severity vulnerability in Cisco Secure Network Analytics with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- EPSS exploit prediction: 0% (39th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-16019
- Weakness: CWE-74
- Affected product: Cisco Secure Network Analytics
- Published:
- Last modified:
Description
A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerability is due to insufficient input validation in specific fields of the web-based management interface. An attacker with valid administrative credentials could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
Frequently asked questions
- What is CVE-2025-20256?
- A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerability is due to insufficient input validation in specific fields of the web-based management interface. An attacker with valid administrative credentials could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
- How severe is CVE-2025-20256?
- CVE-2025-20256 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
- Is CVE-2025-20256 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-20256?
- CVE-2025-20256 primarily affects Cisco Secure Network Analytics. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2025-20256?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-20256 have an EU (EUVD) identifier?
- Yes. CVE-2025-20256 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-16019.
- When was CVE-2025-20256 published?
- CVE-2025-20256 was published on 2025-05-21 and last updated on 2026-06-17.
References
Affected products (5)
- cpe:2.3:a:cisco:secure_network_analytics:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:secure_network_analytics:7.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:secure_network_analytics:7.5.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:secure_network_analytics:7.5.1:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:secure_network_analytics:7.5.2:-:*:*:*:*:*:*
More vulnerabilities in Cisco Secure Network Analytics
- CVE-2023-20102 — High (CVSS 8.8): A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated,…
- CVE-2025-20257 — Medium (CVSS 6.5): A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics…
- CVE-2022-20663 — Medium (CVSS 6.1): A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Stealthwatch…
- CVE-2025-20178 — Medium (CVSS 6.0): A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated,…
- CVE-2022-20797 — Medium (CVSS 5.5): A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch…
- CVE-2022-20741 — Medium (CVSS 5.4): A vulnerability in the web-based management interface of the Network Diagrams application for Cisco Secure Network…
All CVEs affecting Cisco Secure Network Analytics →
Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities
- CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
- CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
- CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
- CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
- CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
- CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…
Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →