The vulnerability in Cisco Finesse permits an unauthenticated attacker to cause the device to retrieve and execute arbitrary files from a remote server during a user session. Insufficient validation of user-supplied URL parameters lets the attacker specify any remote file location, resulting in the browser rendering or executing that content. A successful exploit can deliver arbitrary script code in the context of the Finesse interface or expose sensitive device information.

Cisco Finesse installations are affected. No specific version information is documented in the advisory, so any deployment of Cisco Finesse that has not applied the referenced update may be vulnerable.

The CVSS score of 6.1 indicates moderate risk, and the EPSS score is not reported while the vulnerability is not listed in the KEV catalog. The likely attack vector requires an attacker to persuade a user to click a crafted link that references the Finesse device address; once the link is followed, the device downloads and displays the remote file, enabling the attacker to execute arbitrary scripts in the victim’s browser or compromise device data.