A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to upload arbitrary files to an affected device.
This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted file upload request to a specific API endpoint. A successful exploit could allow the attacker to upload arbitrary files to an affected system. To exploit this vulnerability, an attacker must have at least valid Config Managers credentials on the affected device.
References
| Link | Resource |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epni-arb-file-upload-jjdM2P83 | Vendor Advisory |
Configurations
History
09 Sep 2025, 18:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:* | |
| First Time |
Cisco
Cisco evolved Programmable Network Manager |
|
| References | () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epni-arb-file-upload-jjdM2P83 - Vendor Advisory |
03 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-03 18:15
Updated : 2025-09-09 18:11
NVD link : CVE-2025-20287
Mitre link : CVE-2025-20287
CVE.ORG link : CVE-2025-20287
JSON object : View
Products Affected
cisco
- evolved_programmable_network_manager
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type