CVE-2025-20178

Estado: AnalizadaAlta (7.2)—

A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system.

This vulnerability is due to insufficient integrity checks within device backup files. An attacker with valid administrative credentials could exploit this vulnerability by crafting a malicious backup file and restoring it to an affected device. A successful exploit could allow the attacker to obtain shell access on the underlying operating system with the privileges of root.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.36%
Percentil entre todas las CVEs puntuadas: 28
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %
Impacto secundarioT1553.006 Code Signing Policy Modificationdefense impairment75 %

AV:N/PR:H sugiere T1210 (servicio remoto con privilegios). Ejecución de comandos como root (shell access) es T1059. Restauración maliciosa de backup compromete integridad (CWE-347, firma/verificación insuficiente).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Disable or Remove Feature or Program Vulnerability Scanning Threat Intelligence Program Restrict Web-Based Content Restrict Registry Permissions

Tecnologías afectadas (1)

Cisco — Secure Network Analytics

CWE

CWE-347

Referencias

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-prvesc-4BQmK33Z

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-20178",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-20178",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-17T03:55:25.373925Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco Secure Network Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "7.5.0"
            },
            {
              "status": "affected",
              "version": "7.5.1"
            },
            {
              "status": "affected",
              "version": "7.5.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-04-16T16:15:29.457",
  "references": [
    {
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-prvesc-4BQmK33Z",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system.\r\n\r\n\r\nThis vulnerability is due to insufficient integrity checks within device backup files. An attacker with valid administrative credentials could exploit this vulnerability by crafting a malicious backup file and restoring it to an affected device. A successful exploit could allow the attacker to obtain shell access on the underlying operating system with the privileges of root."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de administración web de Cisco Secure Network Analytics podría permitir que un atacante remoto autenticado con credenciales administrativas válidas ejecute comandos arbitrarios como root en el sistema operativo subyacente. Esta vulnerabilidad se debe a comprobaciones de integridad insuficientes en los archivos de copia de seguridad del dispositivo. Un atacante con credenciales administrativas válidas podría explotar esta vulnerabilidad creando un archivo de copia de seguridad malicioso y restaurándolo en un dispositivo afectado. Una explotación exitosa podría permitir al atacante obtener acceso de shell al sistema operativo subyacente con privilegios de root."
    }
  ],
  "lastModified": "2026-06-17T08:40:59.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABF18A19-D511-4562-9AAD-F9FBC34121CC"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-02-22:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "025680AF-B339-4065-8CA5-942FB80A97B9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-03-08:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B3CD7B2-19C8-440A-82CD-D1E732E00922"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-04-15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFEA7AE2-A95B-46E5-AF06-042ADD270CF8"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-05-15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BEA6EAF-27AC-451D-BFCA-FD494C5C4E40"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-06-10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C20E10B-E9BF-49C8-BD3A-5D095DF5F847"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-07-09:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60882DFF-5B0C-4085-AC88-414657A068EA"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-08-13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C5A7801-A8C0-4157-8DBD-0E28CC17EF24"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-09-12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA79390D-5B85-4682-B80F-E86F620DB577"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-10-15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6436E67A-FF48-4BF5-BF61-A7F212F3DF80"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2024-12-02:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8840C0DF-FD75-4E9C-A469-82858DCEB3AE"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.0:rollup_2025-01-24:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38736546-5137-4E91-97B8-E5E318052F35"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4189BF6-CDE8-4942-9CEC-62CCF5DDB36F"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-08-14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25BA1EA2-F1E0-4D51-8C72-97AD6928EEF3"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-09-18:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "135E7BA4-6024-465E-A3D7-CAA0933990B3"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-10-15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5D61D7A-90F2-4261-A916-1565476C3F72"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2024-11-12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9F2F9D6-C470-43A8-9297-828D7FC64681"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.1:rollup_2025-01-07:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31783A87-5757-4138-BF4B-C6284E8E07BE"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_network_analytics:7.5.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "056011B7-1805-4668-951A-44970D7FAF89"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}