A flaw in the download service API of Cisco Prime Infrastructure allows an authenticated, remote attacker to request any log file from the server. The root cause is insufficient authorization checks on the API, meaning that users who normally do not have permission to view certain logs can retrieve them by crafting a URL. The resulting information disclosure could reveal sensitive operational data, audit trails, or configuration details that support further attacks but does not provide direct code execution or remote access. Severity is classified as moderate with a CVSS score of 4.3.

The vulnerability affects Cisco Prime Infrastructure. No specific product version ranges are listed in the advisory, so all deployed instances are potentially exposed until a fixed release is applied.

The CVSS score indicates a moderate threat level. Because the EPSS score is not available this analysis cannot quantify how often exploitation is attempted currently, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must first obtain valid credentials to the web‑based management interface; thereafter they can submit a crafted request to download arbitrary logs. The lack of broader exploitation data suggests that the vulnerability’s impact will largely depend on the strength of authentication controls and network perimeter protection.