CVE-2025-20272

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada cisco prime infrastructure, cisco evolved programmable network manager. Skor CVSS 3.1 4.3 (Medium) menurut cisco.com.

Deskripsi (NVD)

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.

Rincian

Terbit di NVD

16 Juli 2025

Terakhir diubah

29 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb advisory vendor