Product: Evolved Programmable Network Manager
Summary
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack against users of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-20280 |
Exploitation
To exploit this vulnerability, an attacker must have valid administrative credentials. The attacker can insert malicious code into specific data fields in the web-based management interface. Once the malicious code is stored, it can be executed when other users access the affected interface, leading to potential unauthorized actions or data exposure.
Affected Products
- Cisco Evolved Programmable Network Manager: A management tool for network resources that may be vulnerable to XSS attacks.
- Cisco Prime Infrastructure: A network management solution that could also be affected by this vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper validation of user-supplied input in the web-based management interface. Additionally, users should limit administrative access to trusted personnel and regularly update their systems to incorporate security patches provided by Cisco.