PT-2025-14529 · Cisco · Cisco Prime Infrastructure+1

Jakub Buczak · Published 2025-04-02 · Updated 2025-08-06 · CVE-2025-20120

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure (affected versions not specified)

Description A stored cross-site scripting (XSS) attack could be conducted by an unauthenticated, remote attacker against a user of the web-based management interface on an affected device. This issue is due to insufficient validation of user-supplied input by the interface. An attacker could exploit this by injecting malicious code into specific pages, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-03882

CVE-2025-20120

Affected Products

Cisco Epnm

Cisco Prime Infrastructure

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-20120 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnmpi-sxss-GSScPGY4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03882 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20120 · Vendor Advisory
• https://t.me/cvetracker/20606 · Telegram Post
• https://t.me/cvedetector/21902 · Telegram Post
• https://t.me/cveNotify/131093 · Telegram Post
• https://twitter.com/CVEnew/status/1907551219138384334 · Twitter Post
• https://twitter.com/transilienceai/status/1908126377540235430 · Twitter Post