The flaw resides in the web-based management interface of Cisco Finesse and allows an unauthenticated, remote attacker to send a crafted HTTP request that bypasses input validation. This enables a server-side request forgery that can reach internal services and return limited sensitive information.

The affected product is Cisco Finesse. No specific version numbers are listed in the advisory.

The CVSS score of 7.2 indicates a high severity, and the lack of an EPSS score means we do not have a quantified exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote, unauthenticated via the publicly reachable management interface. An exploitable attacker can potentially inspect or retrieve data from internal services exposed on the network, though the impact is limited to information disclosure rather than full system compromise.