CVE-2025-20287

CWE-434 — Unrestricted File Upload4 documents4 sources
Severity
8.8HIGH
EPSS
0.0%
top 85.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Evolved Programmable Network ManagerCisco Cisco Evolved Programmable Network Manager (epnm)
Timeline
PublishedSep 3
Latest updateSep 9

Description

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted file upload request to a specific API endpoint. A successful exploit could allow the attacker to upload arbitrary fi…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-64x3-j6cg-vq4h: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attack↗2025-09-09
▶
CVEList
Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability↗2025-09-03
▶

📋Vendor Advisories

1
Cisco
Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability↗2025-09-03
▶
CVE-2025-20287 (HIGH CVSS 8.8) | A vulnerability in the web-based ma | cvebase.io