CVE-2025-20272

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Blind SQL Injection Vulnerability

MEDIUM

4.3

CVSS Score

Published: July 16, 2025 at 04:16 PM UTC

Updated: June 29, 2026 at 05:13 PM UTC

2 products affected across 1 vendorPrime InfrastructureEvolved Programmable Network Manager

Using Cisco Evolved Programmable Network Manager (EPNM) by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Evolved Programmable Network Manager (EPNM) - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.3

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Evolved Programmable Network Manager · Cisco

95%

Affected range stops below 8.0.1, so it looks safe — our inference, not a vendor statement

Prime Infrastructure · Cisco

95%

v < 3.10.62.0.0 2.0.10 2.0.39 2.1 2.1.0 2.1.1 2.1.2 2.1.56 2.2 2.2.0 2.2.1 2.2.1 Update 1 2.2.102.2.22.2.2 Update 3 2.2.2 Update 42.2.32.2.3 Update 2 2.2.3 Update 3 2.2.3 Update 4 2.2.3 Update 5 2.2.3 Update 6 2.2.4 2.2.5 2.2.7 2.2.8 2.2.9 3.0.0 3.0.1 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.0.7 3.1.0 3.1.1 3.1.2 3.1.3 3.1.4 3.1.5 3.1.6 3.1.7 3.10 3.10 Update 1 3.10.0 3.10.1 3.10.2 3.10.3 3.10.43.10.4 Update 13.10.4 Update 2 3.10.4 Update 3 3.10.5 3.10.6 3.10.6 Update 1 3.10.6 security_update_01 3.10_DP1 3.1_DP10 3.1_DP11 3.1_DP12 3.1_DP13 3.1_DP14 3.1_DP15 3.1_DP16 3.1_DP4 3.1_DP5 3.1_DP6 3.1_DP7 3.1_DP8 3.1_DP9 3.2 3.2.0-FIPS 3.2.1 3.2.2 3.2_DP1 3.2_DP2 3.2_DP3 3.2_DP4 3.3.0 3.3.0 Update 1 3.3.1 3.3_DP1 3.3_DP2 3.3_DP3 3.3_DP4 3.4.0 3.4.1 3.4.1 Update 1 3.4.1 Update 2 3.4.2 3.4.2 Update 1 3.4_DP1 3.4_DP10 3.4_DP11 3.4_DP2 3.4_DP3 3.4_DP4 3.4_DP5 3.4_DP6 3.4_DP7 3.4_DP8 3.4_DP9 3.5.0 3.5.0 Update 1 3.5.0 Update 2 3.5.0 Update 3 3.5.1 3.5.1 Update 1 3.5.1 Update 2 3.5.1 Update 3 3.5_DP1 3.5_DP2 3.5_DP3 3.5_DP4 3.6.0 3.6.0 Update 1 3.6.0 Update 2 3.6.0 Update 3 3.6.0 Update 4 3.6_DP1 3.7.0 3.7.0 Update 3 3.7.1 3.7.1 Update 1 3.7.1 Update 2 3.7.1 Update 3 3.7.1 Update 4 3.7.1 Update 5 3.7.1 Update 6 3.7.1 Update 7 3.7_DP1 3.7_DP2 3.8.0 3.8.0 Update 1 3.8.0 Update 2 3.8.0-FED 3.8.1 3.8.1 Update 1 3.8.1 Update 2 3.8.1 Update 3 3.8.1 Update 4 3.8_DP1 3.9.0 3.9.0 Update 1 3.9.1 3.9.1 Update 1 3.9.1 Update 2 3.9.1 Update 3 3.9.1 Update 4 3.9_DP1

Affected range stops below 3.10.6, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

References (1)

Vendor Advisory

Source: [email protected]

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.3MEDIUMcisco

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: LOW
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-89

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card