Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability
Summary
| CVE | CVE-2025-20280 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-09-03 18:15:33 UTC |
| Updated | 2026-06-17 08:41:18 UTC |
| Description | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious code into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker must have valid administrative credentials. |
Risk And Classification
Primary CVSS: v3.1 4.8 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.002220000 probability, percentile 0.118440000 (date 2026-10-18)
Problem Types: CWE-79 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | CNA | CVSSV3_1 | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
HighUser Interaction
RequiredScope
ChangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Evolved Programmable Network Manager | 8.1.0 | All | All | All |
| Application | Cisco | Evolved Programmable Network Manager | All | All | All | All |
| Application | Cisco | Prime Infrastructure | All | All | All | All |
| Application | Cisco | Prime Infrastructure | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Cisco | Cisco Evolved Programmable Network Manager EPNM | affected 8.0.0 | Not specified |
| CNA | Cisco | Cisco Evolved Programmable Network Manager EPNM | affected 8.0.0.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.0.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.1.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.1.5 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.6.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.4.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.3.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.2 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.5.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.2.0-FIPS | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.0-FED | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.9.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.0 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.1.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.0.2 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.0.3 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.0.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.5.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.4.2 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.3.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.1.7 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.2.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.2.2 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.1.6 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.1.2 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.4.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.1.3 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.1.4 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.0.6 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.0.4 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.0.5 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.0.7 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.2 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.3 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.1 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.1 Update 03 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.1 Update 04 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.1 Update 06 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.1 Update 07 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.1 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.1 Update 02 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.1 Update 03 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.1 Update 04 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.4.2 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.6.0 Update 04 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.6.0 Update 02 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.6.0 Update 03 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.6.0 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.5.1 Update 03 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.5.1 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.5.1 Update 02 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.0 Update 03 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.0 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.8.0 Update 02 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.1 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.1 Update 02 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.7.1 Update 05 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.3.0 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.4.1 Update 02 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.4.1 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.5.0 Update 03 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.5.0 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.5.0 Update 02 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.4 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.4 Update 01 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.4 Update 02 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.4 Update 03 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.5 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.6 | Not specified |
| CNA | Cisco | Cisco Prime Infrastructure | affected 3.10.6 Update 01 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-p... | [email protected] | sec.cloudapps.cisco.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Exploits
CNA: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
There are currently no legacy QID mappings associated with this CVE.