Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability

🚨SEVERITY: MEDIUM — CVSS 4.8Security Advisory

TL;DR 📌

  • A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. This vulnerability exists because the web-based management interface does not properly validate user-supplied input.…
  • Highest CVSS: 4.8 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20280.

What it is

CVE-2025-20280 is a stored cross-site scripting flaw in the web-based management interface shared by Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure. The interface fails to properly validate user-supplied input in certain data fields, allowing malicious script to be stored and later executed in the browser of another user of that interface.

Exploitation requires an authenticated attacker with valid administrative credentials — this is not an unauthenticated flaw. The attacker inserts crafted content into a data field via the management plane over the network; the payload then runs in the context of the interface when a victim views the affected page, giving the attacker script execution in that session or access to browser-based session data. The CVSS vector reflects this: network vector, low attack complexity, but high privileges required and user interaction needed, with confidentiality and integrity impact limited to the interface session (no availability impact).

Cisco rates this 4.8 (Medium). It is not listed in CISA’s KEV catalogue, and Cisco PSIRT states it is not aware of any public exploitation.

What to do

  • Cisco EPNM: releases 8.0 and earlier are affected — migrate to a fixed release. Release 8.1 is not vulnerable.
  • Cisco Prime Infrastructure: releases 3.9 and earlier are affected — migrate to a fixed release. Release 3.10 is fixed in 3.10.6 Security Update 02.
  • There are no workarounds; the only remediation is upgrading to the versions above.
  • Since exploitation requires valid admin credentials, review who holds administrative access to EPNM/Prime Infrastructure and tighten credential hygiene as a compensating measure while patching is scheduled.
  • Consult the Cisco advisory (cisco-sa-epnm-pi-stored-xss-XjQZsyCP) for the specific bug ID and full release details before planning the upgrade.

For leadership 🧭

Executive summary. An admin account on Cisco EPNM or Prime Infrastructure could be used to plant malicious script that executes in a colleague’s browser session when they view the affected page, exposing session data or interface control. This requires existing admin credentials rather than open network access, so it can be scheduled into a normal patch cycle rather than treated as an emergency.

Why it matters:

  • The flaw sits in the shared web management interface of EPNM and Prime Infrastructure, the tools used to configure and monitor network devices, so a compromised session there has broad operational reach.
  • Exploitation needs valid administrative credentials, meaning the realistic risk comes from a malicious or compromised insider with admin access rather than an anonymous internet attacker.
  • A successful payload runs in another admin’s browser context, potentially exposing browser-based session information or letting the attacker act within that session.
  • There are no workarounds — EPNM 8.0 and earlier and Prime Infrastructure 3.9 and earlier remain exposed until upgraded.

Now / Next / Later:

  • Now: Identify every EPNM and Prime Infrastructure instance in use, confirm their version numbers, and list who currently holds administrative accounts on each.
  • Next: Upgrade EPNM instances to 8.1 and Prime Infrastructure instances to 3.10 with Security Update 02 (or a later fixed release) in the next scheduled change window, since no workaround exists.
  • Later: Tighten and periodically review administrative access to network management platforms like EPNM and Prime Infrastructure, given that this class of flaw depends entirely on who holds admin credentials.

Source