Detections
Analytics

Netapp SnapCenter < 6.0p1 / 6.1 < 6.1P1 Privilege Escalation

critical Nessus Plugin ID 233462

Language:

Synopsis

NetApp SnapCenter running on the remote host is affected by a privilege escalation vulnerability

Description

The version of Netapp SnapCenter installed on the remote host is affected by a privilege escalation vulnerability.
SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to SnapCenter version 6.0P1, 6.1P1 or later

See Also

https://security.netapp.com/advisory/ntap-20250324-0001/

Plugin Details

Severity: Critical

ID: 233462

File Name: snapcenter_6_1p1.nasl

Version: 1.1

Type: remote

Agent: windows

Family: Windows

Published: 3/28/2025

Updated: 3/28/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-26512

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:netapp:snapcenter

Required KB Items: installed_sw/NetApp SnapCenter Server

Patch Publication Date: 3/24/2025

Vulnerability Publication Date: 3/24/2025

Reference Information

CVE: CVE-2025-26512

IAVA: 2025-A-0203