This vulnerability in Cisco Finesse arises from improper validation of user-supplied input in HTTP requests, enabling an unauthenticated remote attacker to load arbitrary files into an active user session. An attacker with knowledge of the device address can craft a link that, when clicked by a user, may lead to browser-based attacks such as script execution or unauthorized access to sensitive information within the interface. The CVSS 3.1 base score is 6.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no availability impact. The vulnerability affects numerous specific versions of Cisco Finesse as listed.

Successful exploitation can allow an attacker to execute arbitrary script code in the context of the affected Cisco Finesse interface or access sensitive information on the device. This could lead to browser-based attacks impacting user sessions. There is no indication of impact on system availability. The attack requires user interaction (clicking a crafted link) and knowledge of the device address.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided data. Until a patch is available, users should exercise caution with unsolicited links referencing Cisco Finesse devices and consider restricting access to the affected interfaces where possible.