CVE-2025-20272
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) allows an authenticated, low-privileged attacker to perform a blind SQL injection attack. The issue is due to insufficient validation of user-supplied input.
Risk Assessment
An attacker could view data in some database tables, potentially leading to the exposure of sensitive configuration or network information.
Recommendation
Apply the patches provided by Cisco in the security advisory immediately and restrict API access to trusted IP addresses only.
Original NVD description (English source)
A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.