© 2026 vulntracker.io

CVE-2025-20120

MEDIUM

6.1

CVSS Score

Published: April 2, 2025 at 04:16 PM UTC

Updated: June 17, 2026 at 08:40 AM UTC

2 products affected across 1 vendorPrime InfrastructureEvolved Programmable Network Manager

Using Cisco Prime Infrastructure by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Prime Infrastructure - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Prime Infrastructure · Cisco

95%

2.0.0 2.0.10 2.0.39 2.1 2.1.0 2.1.1 2.1.2 2.1.56 2.2 2.2.0 2.2.1 2.2.1 Update 1 2.2.1 update01 2.2.102.2.22.2.2 Update 3 2.2.2 Update 4 2.2.2 update03 2.2.2 update042.2.32.2.3 Update 2 2.2.3 Update 3 2.2.3 Update 4 2.2.3 Update 5 2.2.3 Update 6 2.2.3 update02 2.2.3 update03 2.2.3 update04 2.2.3 update05 2.2.3 update06 2.2.4 2.2.5 2.2.7 2.2.8 2.2.9 3.0.0 3.0.1 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.0.7 3.1 device_pack10 3.1 device_pack11 3.1 device_pack12 3.1 device_pack13 3.1 device_pack14 3.1 device_pack15 3.1 device_pack16 3.1 device_pack4 3.1 device_pack5 3.1 device_pack6 3.1 device_pack7 3.1 device_pack8 3.1 device_pack9 3.1.0 3.1.1 3.1.2 3.1.3 3.1.4 3.1.5 3.1.6 3.1.7 3.10 Update 1 3.10 device_pack1 3.10 update01 3.10.0 3.10.1 3.10.2 3.10.3 3.10.43.10.4 Update 13.10.4 Update 2 3.10.4 Update 3 3.10.4 update01 3.10.4 update02 3.10.4 update03 3.10.5 3.10.6 3.10_DP1 3.1_DP10 3.1_DP11 3.1_DP12 3.1_DP13 3.1_DP14 3.1_DP15 3.1_DP16 3.1_DP4 3.1_DP5 3.1_DP6 3.1_DP7 3.1_DP8 3.1_DP9 3.2 3.2 device_pack1 3.2 device_pack2 3.2 device_pack3 3.2 device_pack43.2.0-FIPS3.2.0-fips 3.2.1 3.2.2 3.2_DP1 3.2_DP2 3.2_DP3 3.2_DP4 3.3 device_pack1 3.3 device_pack2 3.3 device_pack3 3.3 device_pack4 3.3.0 3.3.0 Update 1 3.3.0 update01 3.3.1 3.3_DP1 3.3_DP2 3.3_DP3 3.3_DP4 3.4 device_pack1 3.4 device_pack10 3.4 device_pack11 3.4 device_pack2 3.4 device_pack3 3.4 device_pack4 3.4 device_pack5 3.4 device_pack6 3.4 device_pack7 3.4 device_pack8 3.4 device_pack9 3.4.0 3.4.1 3.4.1 Update 1 3.4.1 Update 2 3.4.1 update01 3.4.1 update02 3.4.2 3.4.2 Update 1 3.4.2 update01 3.4_DP1 3.4_DP10 3.4_DP11 3.4_DP2 3.4_DP3 3.4_DP4 3.4_DP5 3.4_DP6 3.4_DP7 3.4_DP8 3.4_DP9 3.5 device_pack1 3.5 device_pack2 3.5 device_pack3 3.5 device_pack4 3.5.0 3.5.0 Update 1 3.5.0 Update 2 3.5.0 Update 3 3.5.0 update01 3.5.0 update02 3.5.0 update03 3.5.1 3.5.1 Update 1 3.5.1 Update 2 3.5.1 Update 3 3.5.1 update01 3.5.1 update02 3.5.1 update03 3.5_DP1 3.5_DP2 3.5_DP3 3.5_DP4 3.6 device_pack1*3.6.0 3.6.0 Update 1 3.6.0 Update 2 3.6.0 Update 3 3.6.0 Update 4 3.6.0 update01 3.6.0 update02 3.6.0 update03 3.6.0 update04 3.6_DP1 3.7 device_pack1 3.7 device_pack2 3.7.0 3.7.0 Update 3 3.7.0 update03 3.7.1 3.7.1 Update 1 3.7.1 Update 2 3.7.1 Update 3 3.7.1 Update 4 3.7.1 Update 5 3.7.1 Update 6 3.7.1 Update 7 3.7.1 update01 3.7.1 update02 3.7.1 update03 3.7.1 update04 3.7.1 update05 3.7.1 update06 3.7.1 update07 3.7_DP1 3.7_DP2 3.8 device_pack1 3.8.0 3.8.0 Update 1 3.8.0 Update 2 3.8.0 update01 3.8.0 update02 3.8.1 3.8.1 Update 1 3.8.1 Update 2 3.8.1 Update 3 3.8.1 Update 4 3.8.1 update01 3.8.1 update02 3.8.1 update03 3.8.1 update04 3.8_DP1 3.9 device_pack1 3.9.0 3.9.0 Update 1 3.9.0 update01 3.9.1 3.9.1 Update 1 3.9.1 Update 2 3.9.1 Update 3 3.9.1 Update 4 3.9.1 update01 3.9.1 update02 3.9.1 update03 3.9.1 update04 3.9_DP1

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnmpi-sxss-GSScPGY4

References (1)

Vendor Advisory

Source: [email protected]

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnmpi-sxss-GSScPGY4

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.1MEDIUMcisco

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: LOW
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card