# CVE-2025-20272: Cisco Prime Infrastructure and EPNM blind SQL injection in REST APIs

Source: https://junglewise.ai/threats/cve-2025-20272-cisco-prime-infrastructure-and-epnm-blind-sql-injection-in-rest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-16. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2025-20272 · Severity: medium · CVSS 4.3 · Published 2025-07-16

Cisco Prime Infrastructure and Evolved Programmable Network Manager are used by IT teams to manage and monitor large-scale enterprise and service provider networks. A security flaw in their programming interface could allow a user with basic login credentials to perform unauthorized database queries. If exploited, an attacker could view sensitive information stored within certain database tables, potentially compromising network configuration details or operational data.

Technologies: [Cisco Evolved Programmable Network Manager](https://junglewise.ai/threats/technologies/evolved-programmable-network-manager), [Cisco Prime Infrastructure](https://junglewise.ai/threats/technologies/prime-infrastructure). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2025-20272 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-20272 being exploited in the wild.

**How severe is CVE-2025-20272?** Medium severity, with a CVSS score of 4.3, published 16 July 2025.

**Which products and versions are affected?** Cisco Evolved Programmable Network Manager up to 8.0.1, 8.1.1; Cisco Prime Infrastructure up to 3.10.6 Security Update 02.

**Is there a fix for CVE-2025-20272?** A patch was published on 2025-07-16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-20272 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-20272?** Check whether you run Cisco Evolved Programmable Network Manager or Cisco Prime Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A blind SQL injection vulnerability exists in a subset of REST APIs within Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM). The flaw is caused by insufficient validation of user-supplied input in API requests. An authenticated, remote attacker with low privileges can exploit this by sending crafted HTTP requests to the affected API endpoints. A successful exploit allows the attacker to retrieve data from various database tables via blind SQL injection techniques. Cisco has released software updates to address this issue; there are no known workarounds.

## Affected products

- Cisco Prime Infrastructure up to 3.10.6 Security Update 02
- Cisco Evolved Programmable Network Manager (EPNM) up to 8.0.1, 8.1.1

## Timeline

- 2025-07-16: disclosed
- 2025-07-16: advisory
- 2025-07-16: patched

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb)

## Related threats

- [Cisco Prime Infrastructure missing authorization in log download API](https://junglewise.ai/threats/cve-2026-20189-cisco-prime-infrastructure-missing-authorization-in-log-download)
- [Cisco EPNM improper authorization in REST API](https://junglewise.ai/threats/cve-2026-20155-cisco-epnm-improper-authorization-in-rest-api)
- [Cisco EPNM and Prime Infrastructure open redirect in web interface](https://junglewise.ai/threats/cve-2026-20123-cisco-epnm-and-prime-infrastructure-open-redirect-in-web)
- [Cisco Prime Infrastructure stored XSS in web management interface](https://junglewise.ai/threats/cve-2026-20111-cisco-prime-infrastructure-stored-xss-in-web-management-interface)