8

CVE-2026-20155

Medienbericht

Cisco Evolved Programmable Network Manager Improper Authorization Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with low privileges to access sensitive information that they are not authorized to access.

This vulnerability is due to improper authorization checks on a REST API endpoint of an affected device. An attacker could exploit this vulnerability by querying the affected endpoint. A successful exploit could allow the attacker to view session information of active Cisco EPNM users, including users with administrative privileges, which could result in the affected device being compromised.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt Cisco Evolved Programmable Network Manager (EPNM)
Default Statusunknown
Version 7.1.1
Status affected
Version 7.1.2.1
Status affected
Version 7.1.3
Status affected
Version 7.1.2
Status affected
Version 7.1.0
Status affected
Version 8.0.0
Status affected
Version 8.0.0.1
Status affected
Version 7.1.3.1
Status affected
Version 7.1.4
Status affected
Version 8.1.0
Status affected
Version 8.1.1
Status affected
Version 8.0.1
Status affected
Version 7.1.4.1
Status affected
Version 8.0.1.1
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.328
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@cisco.com 8 2.1 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.