CVE-2025-54089
LowCVSS 3.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Cross-site scripting (XSS) vulnerability in Secure Access versions prior to 14.10. Attackers with administrative access to the console can interfere with another administrator's access. Low attack complexity, no attack requirements, high privileges required, victim must participate. No impact to confidentiality or availability, low impact to integrity.
Risk Assessment
The risk is the ability to manipulate another administrator's session, potentially leading to unauthorized configuration changes or disruption of system management.
Recommendation
It is recommended to upgrade Secure Access to version 14.10 or later to eliminate the XSS vulnerability.
Other vulnerabilities in Secure Access
See all- CVE-2026-97717Medium
CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service.
- CVE-2026-97716High
CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.
- CVE-2026-97715High
Vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service.
- CVE-2026-97714High
Vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.
- CVE-2026-55402Medium
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an 'in the middle' position can send specially crafted data to a server causing a persistent denial of service.
- CVE-2026-55401Medium
CVE-2026-55401 is a null dereference vulnerability in the load-balancing subsystem of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients.
- CVE-2026-55400Medium
CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.
- CVE-2026-55398Low
A memory management vulnerability in Secure Access clients and servers prior to version 14.55 allows attackers with intimate knowledge and full control over the tunnel protocol to perform a non-persistent DoS against the server.
- CVE-2026-33445Medium
A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a persistent denial of service (DoS).
- CVE-2026-33444Low
A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a non-persistent denial of service (DoS) against the server.
Original NVD description (English source)
CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can interfere with another administrator’s access to the console. The attack complexity is low; there are no attack requirements. Privileges required to execute the attack are high and the victim must actively participate in the attack sequence. There is no impact to confidentiality or availability, there is a low impact to integrity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS