CVE-2025-20178

MEDIUM Year: 2025
CVSS v3 Score
6.0
Medium
Weakness Type
CWE-347
View all →

Vulnerability Description

A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerability is due to insufficient integrity checks within device backup files. An attacker with valid administrative credentials could exploit this vulnerability by crafting a malicious backup file and restoring it to an affected device. A successful exploit could allow the attacker to obtain shell access on the underlying operating system with the privileges of root.

Related Vulnerabilities

CVE-2020-10759

MEDIUM
CVSS:6.0(Medium)

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practic...

CWE-3472020

CVE-2012-2092

MEDIUM
CVSS:5.9(Medium)

A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.

CWE-3472012

CVE-2017-15090

MEDIUM
CVSS:5.9(Medium)

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data...

CWE-3472017

CVE-2018-0501

MEDIUM
CVSS:5.9(Medium)

The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, a...

CWE-3472018

CVE-2018-12556

MEDIUM
CVSS:5.9(Medium)

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does n...

CWE-3472018

CVE-2018-16149

MEDIUM
CVSS:5.9(Medium)

In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponent...

CWE-3472018