This vulnerability exists due to insufficient validation of user-supplied input in the web-based management interface of Cisco Secure FMC Software. An attacker with a valid account assigned the Security Approver, Access Admin, or Network Admin role can send crafted HTTP requests to perform SQL injection. Successful exploitation allows the attacker to extract any data from the backend database, hijack session credentials of authenticated administrators, and execute administrative actions on the affected device.

The vulnerability enables an authenticated remote attacker with certain administrative privileges to perform SQL injection attacks, potentially leading to full compromise of the device's management interface. This includes unauthorized disclosure of sensitive data, session hijacking, and execution of administrative commands, which could severely impact confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted administrators only and monitor for suspicious activity from accounts with Security Approver, Access Admin, or Network Admin roles.