Description
A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cisco | Cisco Evolved Programmable Network Manager (EPNM) | 3.0.1, 3.1.2, 1.2, 3.1.1, 3.1.3, 3.1, 3.0.3, 3.0.2, 3.0, 2.2, 1.1, 2.1, 2.0, 4.1, 4.1.1, 4.0.3, 4.0.1, 4.0.2, 4.0, 5.0, 5.0.1, 5.1.1, 5.1, 5.0.2, 5.1.2, 5.1.3, 5.1.4, 6.1.1, 6.1, 6.0.0, 6.0.1, 6.0.2, 7.0.0, 1.2.5, 1.2.6, 2.0.1, 1.2.2, 1.2.3, 1.2.4, 1.2.7, 1.2.1.2, 2.2.1, 2.1.3, 2.0.2, 2.0.3, 2.1.2,… | — |
| Cisco | Cisco Prime Infrastructure | 3.0.0, 3.1.0, 3.1.5, 2.1, 2.0.0, 3.6.0, 3.7.0, 3.4.0, 3.3.0, 3.2, 3.5.0, 3.2.0-FIPS, 2.2, 3.8.0-FED, 3.9.0, 3.8.0, 3.10.0, 3.1.1, 2.1.2, 2.2.1, 2.2.0, 3.0.2, 3.0.3, 3.0.1, 2.2.2, 2.2.3, 2.1.0, 2.1.1, 3.9.1, 2.0.10, 3.8.1, 3.7.1, 3.5.1, 3.4.2, 3.3.1, 3.1.7, 3.2.1, 3.2.2, 3.1.6, 3.1.2, 3.4.1, 3.1.3, … | — |
Advisories 1
- WID-SEC-2025-1584 Cisco Prime Infrastructure und EPNM: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 16, 2025