This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes 4 vulnerabilities in its products

Cisco fixes 4 vulnerabilities in its products [1][2][3]. Products and their fixes: Cisco Meraki MX Firmware - 18.107.12, 18.211.4, 19.1.4 [1] Cisco Enterprise Chat and Email - 12.6 ES 10 [2] Cisco Evolved Programmable Network Manager - 6.1.2.3, 7.1.3.1, 8.0.0.1 [3] Cisco Prime Infrastructure - 3.10.6.1 [3]

Cisco Meraki MX and Meraki Z Series - DoS (CVE-2025-20212)
CVSS 7.7 (High)

Allows an authenticated remote attacker to carry out a DoS attack on the Cisco AnyConnect VPN server running on an affected Cisco Meraki MX or Cisco Meraki Z series device [1].

The vulnerability is present in product:

  • *:Cisco Meraki MX Firmware; <=16.2; =17.0; >=18.1; <18.107.12; >=18.2, <18.211.4; >=19.1; <19.1.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 2. 4. 2025.

Cisco Enterprise Chat and Email - DoS (CVE-2025-20139)
CVSS 7.5 (High)

Allows an unauthenticated remote attacker, within the chat communication features of Cisco Enterprise Chat and Email, to carry out a DoS attack [2].

The vulnerability is present in product:

  • *:Cisco Enterprise Chat and Email; <12.6 ES 10

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 2. 4. 2025.

Cisco EPNM and Cisco Prime Infrastructure - stored XSS (CVE-2025-20120)
CVSS 6.1 (Medium)

Allows an unauthenticated remote attacker, within the web-based management interface of Cisco EPNM and Cisco Prime Infrastructure, to carry out an XSS attack against a user of this interface on the affected device [3].

The vulnerability is present in products:

  • *:Evolved Programmable Network Manager; <6.1.2.3; >=7.1, <7.1.3.1; >=8.0, <8.0.0.1;
  • *:Cisco Prime Infrastructure; <=3.9; >=3.10, <3.10.6.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-20120 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 4. 2025.

Cisco EPNM and Cisco Prime Infrastructure - stored XSS (CVE-2025-20203)
CVSS 4.8 (Medium)

Allows an authenticated remote attacker, within the web-based management interface of Cisco EPNM and Cisco Prime Infrastructure, to carry out an XSS attack against a user of this interface on the affected device. To exploit this vulnerability, the attacker must have valid administrator credentials [3].

The vulnerability is present in products:

  • *:Cisco Evolved Programmable Network Manager; <=7.1; >=7.1, <7.1.3.1; >=8.0, <8.0.0.1
  • *:Cisco Prime Infrastructure; <=3.9; >=3.10, <3.10.6.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-20203 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 4. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 4. 4. 2025.

CESNET, z.s.p.o. Logo