Cisco Secure Network Analytics API Authorization Vulnerability Allowing Fraudulent Findings

A vulnerability exists in the API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager. It allows an authenticated, remote attacker with low privileges to create false findings that trigger alarms and alerts on the affected product. This issue arises from inadequate authorization enforcement on a specific API, enabling low-privileged users to manipulate analytics reports by obscuring legitimate findings or generating misleading alerts.

Impact

Exploitation of this vulnerability could lead to the generation of false findings and alerts, disrupting the accuracy of analytics reports on the affected device.

Remediation

Cisco has released software updates to address this vulnerability. Users should consult the Cisco Security Advisories page for guidance on upgrading. At the time of publication, users on Cisco Secure Network Analytics Release 7.5.1 and earlier should upgrade to 7.5.2 SMC ROLLUP20250416-01.