Product:
Evolved Programmable Network Manager
Summary
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack against users of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2026-20075 |
Exploitation
To exploit this vulnerability, an attacker must have valid administrative credentials. The attacker can insert malicious code into specific data fields in the web-based management interface. Once the malicious code is stored, it can be executed when other users access the affected interface, leading to potential unauthorized actions or data exposure.
Affected Products
- Cisco Evolved Programmable Network Manager: A management tool for network resources that is vulnerable to stored XSS attacks.
- Cisco Prime Infrastructure: A network management solution that shares the same vulnerability in its web-based interface.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that user input is properly validated and sanitized in the web-based management interface. Additionally, restricting access to the management interface to trusted users and regularly updating the software can help reduce the risk of exploitation.