The vulnerability in Cisco License On‑Prem, documented under CWE‑522, allows an attacker to gain access to credentials that are not properly protected or encrypted. Because those credentials can be used to authenticate to the product’s administrative functions, an adversary who obtains them can potentially achieve privileged access or unauthorized configuration changes, undermining both confidentiality and integrity of the system.

The issue is present in Cisco License On‑Prem software. No specific version identifiers were supplied, so all deployments of the product may be affected until the hardening release is applied.

The CVSS score of 9.1 classifies this as a high severity flaw, and although EPSS data is not available, the lack of a KEV listing does not diminish the potential impact. The vulnerability is exploitable remotely over the network whenever an attacker can reach the product’s services. The likely attack vector is a remote attacker sending a request that triggers the credential disclosure mechanism, which is inferred from the nature of credential protection weaknesses.