An unauthenticated, remote attacker can send specially crafted SQL commands through the Ciser System SL CSIP firmware login interface. The flaw exists because user input is incorporated directly into database queries without proper parameterization, a classic SQL injection weakness (CWE-89). Exploitation of this vulnerability allows the attacker to fully compromise the system’s configuration data, affecting both confidentiality and integrity of sensitive information. The attack is possible from an external endpoint with no authentication or privilege escalation required, and the availability of the service is not impacted.

The affected product is the Ciser System SL CSIP firmware. All firmware releases prior to version 5.3 lack the improved input validation and parameterized queries introduced in version 5.3, and therefore remain vulnerable. Any device running these unpatched firmware versions should be identified and upgraded.

The CVSS score of 9.3 classifies this flaw as Critical, and the EPSS score of less than 1% indicates a low probability of exploitation in the current data set. Because the vulnerability can be triggered by an unauthenticated, remote attacker without special privileges, the risk is largely driven by the ease of exploitation and the high impact on configuration integrity and confidentiality. The flaw is not listed in the CISA KEV catalog, but its severity and exploitation simplicity warrant prompt mitigation.