The vulnerability involves improper neutralization of special elements in output that is consumed by a downstream component. This flaw may allow an attacker to inject specially crafted characters or sequences into the output, potentially leading to unintended behavior such as injection attacks, command execution, or data leakage. Classified as CWE-74, it carries a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, or availability.

The affected products include Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, and Cisco Unity Connection. Version information was not supplied, so all current releases are potentially vulnerable until a patch is applied.

The high CVSS rating indicates that exploitation is serious. An attacker may potentially exploit the flaw by sending specially crafted requests to the vulnerable service. The EPSS score of 0.0049 indicates a very low but nonzero exploitation probability, and the absence of a KEV listing does not diminish the severity. It is inferred that the most probable attack vector is a remote network-based request to the affected service, likely targeting unauthenticated or weakly authenticated interfaces.