CVE-2025-54088
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbitrary URL. The attack complexity is low, attack requirements are present, no privileges are required, and users must actively participate in the attack. Impact to confidentiality is low and there is no impact to integrity or availability. There are high severity impacts to confidentiality, integrity, availability in subsequent systems.
Risk Assessment
An attacker can redirect users to malicious sites, potentially leading to phishing or malware infection, with high severity impacts to confidentiality, integrity, and availability in subsequent systems.
Recommendation
Update Secure Access to version 14.10 or later and implement validation of redirect target URLs.
Other vulnerabilities in Secure Access
See all- CVE-2026-116768High
CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. An authenticated attacker can cause a persistent denial of service when connecting for the first time.
- CVE-2026-116767High
CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. An authenticated attacker can cause a persistent denial of service.
- CVE-2026-116766High
CVE-2026-116766 is an improper input handling vulnerability in Secure Access server versions between 13.0 and prior to 14.61. An attacker can cause a persistent denial of service of the server.
- CVE-2026-97717Medium
CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service.
- CVE-2026-97716High
CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.
- CVE-2026-97715High
Vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service.
- CVE-2026-97714High
Vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.
- CVE-2026-55402Medium
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an 'in the middle' position can send specially crafted data to a server causing a persistent denial of service.
- CVE-2026-55401Medium
CVE-2026-55401 is a null dereference vulnerability in the load-balancing subsystem of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients.
- CVE-2026-55400Medium
CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.
Original NVD description (English source)
CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbitrary URL. The attack complexity is low, attack requirements are present, no privileges are required, and users must actively participate in the attack. Impact to confidentiality is low and there is no impact to integrity or availability. There are high severity impacts to confidentiality, integrity, availability in subsequent systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS