Product:
Evolved Programmable Network Manager
Summary
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-20123 |
Exploitation
To exploit this vulnerability, an attacker must intercept an HTTP request from a user and modify it to include malicious parameters. This can be achieved through various methods such as man-in-the-middle attacks. Once the request is altered, the user may be redirected to a malicious web page without their knowledge, potentially leading to further exploitation.
Affected Products
- Cisco Evolved Programmable Network Manager: Affected by improper input validation in the web-based management interface.
- Cisco Prime Infrastructure: Also vulnerable to the same input validation issue, allowing for user redirection.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper input validation and ensure that all HTTP requests are securely handled. Users should also be cautious of unexpected redirects and ensure that they are accessing legitimate web pages.