CVE-2025-20280: evolved programmable network manager 8.1.0; +3 more affected products

Affected technology

evolved programmable network manager · through 8.0.0 (inclusive)
cisco

evolved programmable network manager · 8.1.0
cisco

prime infrastructure · through 3.9 (inclusive)
cisco

prime infrastructure · from 3.10 (inclusive), through 3.10.6 (inclusive)
cisco

Cisco Evolved Programmable Network Manager (EPNM) · 8.0.0, 8.0.0.1
Cisco

Cisco Prime Infrastructure · 3.0.0, 3.1.0, 3.1.5, 3.6.0, 3.7.0, 3.4.0, 3.3.0, 3.2, 3.5.0, 3.2.0-FIPS, 3.8.0-FED, 3.9.0, 3.8.0, 3.10.0, 3.1.1, 3.0.2, 3.0.3, 3.0.1, 3.8.1, 3.7.1, 3.5.1, 3.4.2, 3.3.1, 3.1.7, 3.2.1, 3.2.2, 3.1.6, 3.1.2, 3.4.1, 3.1.3, 3.1.4, 3.0.6, 3.0.4, 3.0.5, 3.0.7, 3.10.2, 3.10.3, 3.10, 3.10.1, 3.7.1 Update 03, 3.7.1 Update 04, 3.7.1 Update 06, 3.7.1 Update 07, 3.8.1 Update 01, 3.8.1 Update 02, 3.8.1 Update 03, 3.8.1 Update 04, 3.4.2 Update 01, 3.6.0 Update 04, 3.6.0 Update 02, 3.6.0 Update 03, 3.6.0 Update 01, 3.5.1 Update 03, 3.5.1 Update 01, 3.5.1 Update 02, 3.7.0 Update 03, 3.8.0 Update 01, 3.8.0 Update 02, 3.7.1 Update 01, 3.7.1 Update 02, 3.7.1 Update 05, 3.3.0 Update 01, 3.4.1 Update 02, 3.4.1 Update 01, 3.5.0 Update 03, 3.5.0 Update 01, 3.5.0 Update 02, 3.10.4, 3.10.4 Update 01, 3.10.4 Update 02, 3.10.4 Update 03, 3.10.5, 3.10.6, 3.10.6 Update 01
Cisco

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · User interaction required

What an attacker can do

An authenticated, remote attacker could conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. Vendor/CNA’s CVSS 3.1 assessment (base score 4.8/10) rates confidentiality and integrity impact as low; availability impact as none.