Arbitrary File Upload Vulnerability in Cisco Evolved Programmable Network Manager
CVE-2025-20287

4.3MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Evolved Programmable Network Manager (epnm)
Vendor
CVE Published:
3 September 2025

Badges

👾 Exploit Exists

What is CVE-2025-20287?

A vulnerability exists in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM), allowing authenticated remote attackers to upload arbitrary files to affected devices. This issue arises from inadequate validation of uploaded files. By sending a specially crafted file upload request to a designated API endpoint, a valid Config Manager credential holder could exploit this flaw, potentially compromising the integrity and confidentiality of the system.

Affected Version(s)

Cisco Evolved Programmable Network Manager (EPNM) 7.0.0

Cisco Evolved Programmable Network Manager (EPNM) 7.1.1

Cisco Evolved Programmable Network Manager (EPNM) 7.1.2.1

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20287 : Arbitrary File Upload Vulnerability in Cisco Evolved Programmable Network Manager