The vulnerability stems from a lack of proper file access checks in the web-based management interface of Cisco IoT Field Network Director, allowing an authenticated user with low privileges to retrieve arbitrary files. The flaw permits reading files that the user should not have permission to access, leading to potential exposure of sensitive configuration data, credentials, or proprietary information. It is classified as a CWE-388 Security Misconfiguration.

Affected product is Cisco IoT Field Network Director (IoT-FND). No version information is provided, so any deployment of this product is potentially vulnerable until a patch is applied.

The CVSS score of 6.5 indicates moderate severity. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. The flaw requires authentication and low privileges, meaning only compromised or poorly protected accounts can exploit it. An attacker with such access could read configuration files and other sensitive data. The likely attack vector is remote, via the web-based management interface.