The vulnerability results from insufficient neutralization of special characters used in SQL commands, allowing an attacker to insert arbitrary SQL when interacting with affected services. This flaw is classified under CWE‑89 and can enable the attacker to read, modify, or delete database contents, thereby compromising confidentiality, integrity, and potentially availability of the system. The vulnerability could be triggered through user‑controlled input in web or API interfaces; while the specific input vectors are not disclosed, the description suggests that form fields or query parameters are likely involved, and the impact scope extends across the system’s data store.

Affected vendors include Cisco, with products Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection. No specific version information is provided, so all current releases of these products are considered potentially vulnerable.

The CVSS score of 8.8 denotes a high‑severity risk, and although EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, the lack of mitigation details suggests an exploitable attack surface. The likely attack vector involves unsanitized user input to web or API interfaces, permitting SQL injection. Attackers who succeed could obtain or alter sensitive data stored in the affected systems.