This vulnerability arises from insufficient input validation and missing authentication in the Cisco Smart Licensing Utility API. An unauthenticated remote attacker can send a crafted request that causes the application to write arbitrary files to the operating system or trigger a denial‑of‑service condition. The ability to create or overwrite arbitrary files can lead to privilege escalation, tampering with system configuration, or execution of malicious code, thereby compromising system integrity and availability.

Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem, is impacted. All deployments of this product are vulnerable unless patched. Specific versions are not disclosed; therefore any installation of the Cisco License On-Prem utility is at risk.

The CVSS score of 9.1 indicates critical severity, and the absence of authentication makes the attack trivial for a remote attacker. The EPSS score is unavailable, but the lack of safeguards suggests a high exploitation likelihood. The vulnerability is not listed in CISA KEV, but its potential to allow arbitrary file writes or a DoS condition makes it a serious threat to confidentiality, integrity, and availability.