CVE-2025-20269

MEDIUM EPSS 30.4%
Published Aug 20, 202510mo ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Aug 20, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the underlying file system on an affected device. This vulnerability is due to insufficient input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface on an affected device. A successful exploit could allow the attacker to access sensitive files from the affected device.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
30.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-73

Affected Products 6

VendorProductVersionRange
ciscoevolved_programmable_network_manager* ≤7.1.0
ciscoevolved_programmable_network_manager8.0.0any
ciscoevolved_programmable_network_manager8.1.0any
ciscoprime_infrastructure* ≤3.9
ciscoprime_infrastructure*≥3.10  –  ≤3.10.6
ciscoprime_infrastructure3.10.6any

References 4

  • bst.cloudapps.cisco.com https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd36820
    Permissions RequiredProduct
  • sec.cloudapps.cisco.com https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
    Not Applicable
  • sec.cloudapps.cisco.com https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-TET4GxBX
    Vendor Advisory
  • sec.cloudapps.cisco.com https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-66682
    Not Applicable

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.