A vulnerability in an internal service of Cisco Identity Services Engine (ISE) and its passive connector component allows an unauthenticated remote attacker to retrieve sensitive configuration information. The flaw stems from missing authentication on the Policy Runtime Repository Table (PRRT) service, permitting a crafted request to expose internal settings. The primary consequence is disclosure of confidential configuration data, which could provide attackers with insight into network policies, user roles, and device credentials.

Affected products include Cisco Identity Services Engine software and Cisco ISE Passive Identity Connector. The CVE does not list specific affected versions, so any deployment of these products prior to an eventual vendor patch may be vulnerable.

The flaw received a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, reflecting a low probability of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires remote, unauthenticated access to the device's internal PRRT service. Once the attacker sends a crafted request, the service will return configuration details. While the probability of exploitation is low, the disclosure of configuration data could aid further attacks or information gathering.