The vulnerability stems from an improper limitation of a pathname to a restricted directory (CWE-22). An attacker who can supply a crafted file path could traverse outside the intended directory, potentially reading or writing sensitive files or configurations. This weakness can be leveraged to compromise the confidentiality, integrity, or availability of the affected system if the attacker can influence the pathname used by the application.

Affected products include Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection. The advisory does not list affected versions, and while it states that a hardening release addresses these vulnerabilities, it does not confirm that the release applies to all current versions of these products.

The vulnerability carries a CVSS score of 7.8, indicating high severity. No EPSS data is available, and the vulnerability is not yet listed in CISA's KEV catalog. The likelihood of exploitation depends on network exposure; the attack vector is inferred to be remote via exposed management or web interfaces that accept file paths. Because the weakness involves directory traversal, an attacker could gain elevated read/write capabilities if the service has sufficient privileges. In the absence of known exploitation, the risk remains elevated until a patch is applied.