The vulnerability is a classic SQL injection flaw arising from insufficient input validation in the web‑based management console of Cisco License On‑Prem. An attacker who already has valid administrative credentials can send a specially crafted request that bypasses the application’s safeguards and injects arbitrary SQL code. Successful exploitation allows the attacker to read sensitive data from the internal database that should be protected from even privileged users, directly compromising confidentiality.

Cisco License On‑Prem, formerly known as Cisco Smart Software Manager On‑Prem, is impacted. No specific version range is listed, so any installation of the product that has not been updated to the latest release should be considered at risk unless verified.

The CVSS v3 base score of 4.9 indicates a moderate severity. EPSS is not published, and the vulnerability is not in the CISA KEV catalog, suggesting exploit activity is currently low. However, because the flaw requires authenticated administrative access and is exploitable remotely via the web interface, an attacker with those credentials can gain unauthorized data exposure. The risk is primarily confidentiality loss, and the likelihood of exploitation is moderate pending active threat intelligence.