A flaw in the RADIUS Policy API endpoints of Cisco Identity Services Engine allows an authenticated, remote attacker with read‑only Administrator privileges to bypass the web‑based management interface and retrieve sensitive RADIUS policy details that should be restricted for that role. The violation of role‑based access control permits disclosure of confidential configuration information, potentially enabling further subversive actions.

The vulnerability affects Cisco Identity Services Engine Software. Specific release versions are not enumerated in the advisory, so all current installations should be reviewed for the presence of the exposed API endpoints.

With a CVSS score of 4.3 the risk is considered moderate. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating limited known exploitation. The vulnerability requires the attacker to possess an authenticated account with a read‑only Administrator role, implying that internal or compromised credentials facilitate exploitation. Attackers can trigger the exploit by directly invoking the targeted API endpoint, thereby gaining unauthorized read access.