CVE-2025-20272 Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Blind SQL Injection Vulnerability

Medium 4.3 Published 16 Jul 2025 Updated 18 Jul 2025

Authenticated low-privileged attackers can perform blind SQL injection via REST APIs to view database table data in Cisco Prime Infrastructure and EPNM.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20272?

CVE-2025-20272 is a medium-severity SQL injection vulnerability in Cisco Evolved Programmable Network Manager, published on 16 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.

Weakness: CWE-89

Which versions are affected by CVE-2025-20272?

It affects 2 products.

Products include Cisco Evolved Programmable Network Manager, Cisco Prime Infrastructure.

How do I fix CVE-2025-20272?

No fix has been published for CVE-2025-20272 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-20272 being exploited?

There is no known exploitation of CVE-2025-20272 in the wild and no public exploit code.

All Cisco Evolved Programmable Network Manager vulnerabilities

Sources

Also known as GHSA-c34r-h49j-vq6w.