CVE-2025-20269: cisco cisco evolved programmable network manager (epnm) External Control of File Name or Path
Vulnerability summary
CVE-2025-20269 is a medium (CVSS 6.5) External Control of File Name or Path vulnerability in cisco cisco evolved programmable network manager (epnm). EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.1% of scored vulnerabilities.
Timeline
- 20-08-2025PublishedVulnerability first disclosed.
- 20-08-2025Last modifiedVulnerability information updated.
Description
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the underlying file system on an affected device. This vulnerability is due to insufficient input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface on an affected device. A successful exploit could allow the attacker to access sensitive files from the affected device.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
0.00 pp
From 0.42% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco4 products
- cisco evolved programmable network manager (epnm)7.0.0 | 7.1.1 | 7.1.2.1 | 7.1.3 | 7.1.2 | 7.0.1.2 | 7.0.1.1 | 7.0.1 | 7.1.0 | 8.0.0 | 8.0.0.1 | 8.1.0 | 8.0.1
- cisco prime infrastructure3.10.0 | 3.10.2 | 3.10.3 | 3.10 | 3.10.1 | 3.10 Update 01 | 3.10.4 | 3.10.4 Update 01 | 3.10.4 Update 02 | 3.10.4 Update 03 | 3.10.5 | 3.10.6 | 3.10.6 Update 01
- evolved_programmable_network_manager≤ 7.1.0 | 8.0.0 | 8.1.0
- prime_infrastructure≤ 3.9 | ≥ 3.10, ≤ 3.10.6 | 3.10.6:security_update_01
1 vendor · 4 products