Product: Evolved Programmable Network Manager
Summary
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack against users of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-20280 |
Exploitation
To exploit this vulnerability, an attacker must have valid administrative credentials. The attacker can insert malicious code into specific data fields in the web-based management interface. Once the malicious code is stored, it can be executed when users interact with the affected interface, leading to potential unauthorized access to sensitive information.
Affected Products
- Cisco Evolved Programmable Network Manager: A management tool for network resources that may be vulnerable to XSS attacks.
- Cisco Prime Infrastructure: A network management solution that could also be affected by this vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper validation of user-supplied input in the web-based management interface. Additionally, restricting access to the management interface to trusted users and regularly updating the software can help reduce the risk of exploitation.