CVE-2025-20120 Overview
CVE-2025-20120 is a stored cross-site scripting (XSS) vulnerability affecting the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure. An unauthenticated, remote attacker can inject malicious script into specific interface pages, which executes when an authenticated user later views the affected content. Successful exploitation allows arbitrary script execution in the victim's browser session or disclosure of browser-based information such as cookies and session tokens. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
An unauthenticated attacker can persistently store JavaScript in the EPNM or Prime Infrastructure management UI, hijacking administrator sessions when they view the poisoned page.
Affected Products
- Cisco Evolved Programmable Network Manager (EPNM) — versions 1.2 through 7.1.3
- Cisco Prime Infrastructure — versions 2.0.0 through 3.10.6
- Web-based management interface component on both products
Discovery Timeline
- 2025-04-02 - CVE-2025-20120 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-20120
Vulnerability Analysis
The defect resides in the web-based management interface used to administer Cisco EPNM and Prime Infrastructure. The application does not sufficiently validate or neutralize user-supplied input before rendering it in HTML responses. Because the injected payload is stored server-side, any user who subsequently loads the affected page executes the attacker-controlled script in the origin of the management console.
EPNM and Prime Infrastructure are network management platforms used to provision, monitor, and troubleshoot large service-provider and enterprise networks. Compromise of an administrator session gives an attacker visibility into managed device inventories, credentials cached by the platform, and the ability to pivot to network configuration workflows. The scope-change indicator in the CVSS vector reflects that the injected script operates against a different security authority — the browser of the authenticated victim — than the vulnerable server itself.
Root Cause
The root cause is insufficient input validation and output encoding on specific pages of the management UI. User-supplied strings are persisted and later reflected into HTML contexts without contextual escaping, allowing HTML and JavaScript tokens to break out of intended data contexts and execute as code.
Attack Vector
Exploitation is network-based and requires no authentication to plant the payload, but it does require user interaction: an authenticated administrator or operator must load the page containing the stored input. The attacker submits crafted input to a vulnerable endpoint, the server stores it, and the payload triggers on subsequent views. Because no verified public proof-of-concept or exploit code is available for CVE-2025-20120, no exploitation code is reproduced here. Refer to the Cisco Security Advisory for vendor-supplied technical detail.
Detection Methods for CVE-2025-20120
Indicators of Compromise
- HTTP POST or PUT requests to EPNM or Prime Infrastructure endpoints containing HTML tags, <script>, javascript:, or event-handler attributes such as onerror= and onload= in parameter values.
- Outbound requests from administrator browsers to unfamiliar external hosts shortly after loading management console pages.
- Unexpected session token reuse or administrator sessions originating from new IP addresses following a UI page view.
Detection Strategies
- Inspect web application firewall and reverse-proxy logs for requests to the EPNM or Prime Infrastructure management interface that carry HTML or script fragments in POST bodies or query strings.
- Correlate stored user-input fields — asset labels, custom names, description fields — against a deny-list of HTML control characters and script keywords.
- Review browser telemetry from administrator workstations for anomalous script execution or cross-origin requests originating from the management console URL.
Monitoring Recommendations
- Enable verbose access logging on the EPNM and Prime Infrastructure web tier and forward logs to a centralized analytics platform for retention and search.
- Alert on any change to persistent metadata fields performed by unauthenticated or anonymous sessions.
- Monitor administrator browser sessions for content security policy (CSP) violations if CSP headers are deployed as a compensating control.
How to Mitigate CVE-2025-20120
Immediate Actions Required
- Identify all EPNM and Prime Infrastructure instances in the environment and confirm versions against the vendor advisory.
- Restrict network access to the management interface to a defined administrative subnet or jump-host, reducing exposure to unauthenticated attackers.
- Instruct administrators to log out of the management console when not in active use and to avoid opening the UI in browsers used for general web browsing.
Patch Information
Cisco has published guidance for this issue in the Cisco Security Advisory cisco-sa-epnmpi-sxss-GSScPGY4. Apply the fixed release identified in that advisory for your specific EPNM or Prime Infrastructure train. Prime Infrastructure has reached end-of-software-maintenance for older trains; environments still running unsupported versions should plan migration to a supported EPNM release.
Workarounds
- Place the management interface behind a reverse proxy or WAF configured to strip or reject HTML and script content in request parameters bound for known-vulnerable endpoints.
- Enforce network segmentation so only trusted administrative workstations can reach the EPNM or Prime Infrastructure UI on TCP 443.
- Require administrators to use a dedicated, hardened browser profile for network management tasks to limit exposure of cookies from other sites.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
