CVE-2025-20270: evolved programmable network manager through 7.1.0 (inclusive), from 8.0.0 (inclusive), before 8.0.1 (exclusive), from…

Affected technology

evolved programmable network manager · through 7.1.0 (inclusive)
cisco

evolved programmable network manager · from 8.0.0 (inclusive), before 8.0.1 (exclusive)
cisco

evolved programmable network manager · from 8.1.0 (inclusive), before 8.1.2 (exclusive)
cisco

prime infrastructure · through 3.9 (inclusive)
cisco

prime infrastructure · from 3.10 (inclusive), through 3.10.6 (inclusive)
cisco

Cisco Evolved Programmable Network Manager (EPNM) · 7.0.0, 7.1.1, 7.1.2.1, 7.0.1.3, 7.1.3, 7.1.2, 7.0.1.2, 7.0.1.1, 7.0.1, 7.1.0
Cisco

Cisco Prime Infrastructure · 3.9.0, 3.10.0, 3.9.1, 3.10.2, 3.10.3, 3.10, 3.10.1, 3.9.1 Update 01, 3.9.1 Update 02, 3.9.1 Update 03, 3.9.1 Update 04, 3.9.0 Update 01, 3.10.4, 3.10.4 Update 01, 3.10.4 Update 02, 3.10.4 Update 03, 3.10.5, 3.10.6, 3.10.6 Update 01
Cisco

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated, remote attacker could obtain sensitive information from an affected system. Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity and availability impact as none.