6.5 Medium

CVE-2025-20269 A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco…

Description

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the underlying file system on an affected device. This vulnerability is due to insufficient input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface on an affected device. A successful exploit could allow the attacker to access sensitive files from the affected device.

Affected products and versions

Product	Affected versions	Fixed in
Cisco Evolved Programmable Network Manager (EPNM)	8.1.0	No fix stated
Cisco Evolved Programmable Network Manager (EPNM) 8.0	8.0.0 → 8.0.1	No fix stated
Cisco Evolved Programmable Network Manager (EPNM) 7.1	7.1.0 → 7.1.3	No fix stated
Cisco Evolved Programmable Network Manager (EPNM) 7.0	7.0.0 → 7.0.1.2	No fix stated
Cisco Prime Infrastructure 3.10	3.10 → 3.10.6	No fix stated

References

cisco-sa-pi-epnm-TET4GxBX sec.cloudapps.cisco.com
CSCvd36820 bst.cloudapps.cisco.com
sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Cisco Event Response: March 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication sec.cloudapps.cisco.com

Timeline

Published August 20, 2025
Last modified August 20, 2025

The 21 CVEs of Cisco Evolved Programmable Network Manager (EPNM) →

CVE-2026-20155 A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow… 8.0 High CVE-2026-20123 A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco… 4.3 Medium CVE-2026-20075 A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco… 4.8 Medium CVE-2025-20280 A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco… 4.8 Medium

Track this CVE