Cisco Prime Infrastructure vulnerabilities

CVE-2016-1290 [HIGH] CWE-264 CVE-2016-1290: The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Networ The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.

CVE-2019-1819 [MEDIUM] CWE-22 CVE-2019-1819: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolve A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP req

CVE-2019-1820 [MEDIUM] CWE-22 CVE-2019-1820: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolve A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP req

CVE-2019-1818 [MEDIUM] CWE-22 CVE-2019-1818: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolve A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP req

CVE-2022-20656 [MEDIUM] CWE-24 CVE-2022-20656: A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could all A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the system. This vulnerability is due to insufficient input validation of the HTTPS URL by

CVE-2025-20269 [MEDIUM] CWE-73 CVE-2025-20269: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the underlying file system on an affected device. This vulnerability is due to insufficient input validation for specif

CVE-2019-1659 [HIGH] CWE-295 CVE-2019-1659: A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastruct A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer (SSL) tunnel established between ISE and PI. The vulnerability is due to improper validation of the server SSL certificate when

CVE-2023-20271 [MEDIUM] CWE-89 CVE-2023-20271: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolve A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vu

CVE-2025-20270 [MEDIUM] CWE-200 CVE-2025-20270: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to API endpoints. An attacker could exploit this

CVE-2019-1906 [MEDIUM] CWE-264 CVE-2019-1906: A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure (PI) could allow an authe A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure (PI) could allow an authenticated, remote attacker to change the virtual domain configuration, which could lead to privilege escalation. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by manipulating requests sent t

CVE-2017-3884 [MEDIUM] CWE-200 CVE-2017-3884: A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Ne A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to access sensitive data. The attacker does not need administrator credentials and could use this information to conduct additional reconnaissance attacks. More Information: CSCvc60031 (F

CVE-2017-6698 [MEDIUM] CWE-89 CVE-2017-6698: A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPN A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc23892 CSCvc35270 CSCvc35626 CSCvc35630 CS

CVE-2018-0096 [MEDIUM] CWE-264 CVE-2018-0096: A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to a failure to properly enforce RBAC for virtual domains.

CVE-2016-1358 [MEDIUM] CWE-119 CVE-2016-1358: Cisco Prime Infrastructure 2.2, 3.0, and 3.1(0.0) allows remote authenticated users to read arbitrar Cisco Prime Infrastructure 2.2, 3.0, and 3.1(0.0) allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCuw81497.

CVE-2026-20123 [MEDIUM] CWE-601 CVE-2026-20123: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could exploit t

CVE-2020-3339 [MEDIUM] CWE-89 CVE-2020-3339: A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an a A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and send

CVE-2023-20129 [MEDIUM] CWE-27 CVE-2023-20129: Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cis Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see th

CVE-2023-20127 [MEDIUM] CWE-27 CVE-2023-20127: Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cis Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see th

CVE-2023-20260 [MEDIUM] CWE-284 CVE-2023-20260: A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacker could exploit this vulnerability by issuing a comm

CVE-2022-20657 [MEDIUM] CWE-79 CVE-2022-20657: A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could all A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit