A vulnerable REST API in Cisco Secure FMC Software permits an authenticated remote attacker to inject SQL statements due to insufficient input validation; by sending crafted API requests, an attacker can read data from the application database and retrieve selected operating‑system files, which enables disclosure of sensitive configuration and data information without granting write or execution privileges.

Impact falls on Cisco Secure Firewall Management Center (FMC) devices; all deployments running the affected firmware are potentially vulnerable as specific product versions were not listed. The flaw requires valid user credentials with one of the following roles: Administrator, Security approver, Access admin, or Network admin, allowing these users to exploit the REST API endpoints to perform the injection.

The CVSS v3 score of 6.5 classifies the issue as moderate. EPSS indicates a current exploitation likelihood below 1%, suggesting a low probability of attacker activity presently, and the flaw is not present in CISA's KEV catalog. The attack vector is a remote, authenticated request to the REST API; an attacker must first compromise or obtain valid credentials with sufficient privileges. Successful exploitation grants read‑only access to the database and limited file read capabilities, posing a confidentiality risk to sensitive firewall configuration and logs.