A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the underlying file system on an affected device. This vulnerability is due to insufficient input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface on an affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-20269 |
Exploitation
To exploit this vulnerability, an attacker must be authenticated with low privileges and send specially crafted HTTP requests to the web-based management interface of the affected device. If successful, the attacker can retrieve sensitive files from the device’s file system.
Affected Products
- Cisco Evolved Programmable Network Manager (EPNM): A network management solution that provides visibility and control over network resources.
- Cisco Prime Infrastructure: A unified network management platform that simplifies the management of wired and wireless networks.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco for the affected products. Additionally, ensure that access to the web-based management interface is restricted to trusted users and networks.