Product: Cisco Evolved Programmable Network Manager
Summary
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to API endpoints. An attacker could exploit this vulnerability by sending a valid request to a specific API endpoint within the affected system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-20270 |
Exploitation
To exploit this vulnerability, an attacker must have access as a low-privileged user. By sending a valid request to a specific API endpoint, the attacker can view sensitive configuration information that should be restricted. This could lead to unauthorized access to sensitive data within the affected system.
Affected Products
- Cisco Evolved Programmable Network Manager: A management tool for network resources that may expose sensitive information due to improper API request validation.
- Cisco Prime Infrastructure: A network management solution that could also be affected by the same vulnerability, allowing unauthorized information access.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper access controls are in place and limit the privileges of low-privileged users. Regularly updating the system and monitoring API requests can also help in identifying and preventing potential exploitation.