The vulnerability resides in the API Server of Skill Scanner, caused by an erroneous binding to multiple network interfaces. An unauthenticated, remote attacker can send API requests to the exposed server. Successful exploitation can trigger a denial of service by exhausting memory resources or enable the attacker to upload arbitrary files to any folder on the device. This can compromise data integrity and availability.

The affected product is Cisco AI Defense’s Skill Scanner, versions 1.0.1 and earlier when the API Server is enabled. The API Server is not enabled by default, but when it is active the vulnerability exists. Version 1.0.2 and later contain the fix.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers likely rely on network access to the device; no authentication is required to issue the API calls that trigger the resource exhaustion or file upload. Because the flaw is straightforward, an attacker could potentially exploit it in a production environment if the API Server remains exposed over the network.