CVEvulnerability

CVE-2025-20272

4.3 MEDIUM Published 2025-07-16 Modified 2026-06-29 Official page ↗
Status
Analyzed
Published
2025-07-16
Last modified
2026-06-29
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-89

Description

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.

Affected configurations

• cisco prime infrastructure (< 3.10.6) • cisco prime infrastructure 3.10.6 • cisco evolved programmable network manager (< 8.0.1) • cisco evolved programmable network manager 8.1.0

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References