CVE-2023-20260

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-17 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacker could exploit this vulnerability by issuing a command on the CLI with malicious options. A successful exploit could allow the attacker to gain the escalated privileges of the root user on the underlying operating system.

Affected products

Cisco Evolved Programmable Network Manager (EPNM): before 7.1.1 — fixed in 7.1.1
Cisco Prime Infrastructure: before 3.10.4; 3.10.4, 3.10.4-update_1 — fixed in 3.10.4

How to fix

Upgrade to a fixed version: Cisco Evolved Programmable Network Manager (EPNM) 7.1.1; Cisco Prime Infrastructure 3.10.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-20260 or the next vulnerability affects your stack