This vulnerability in Cisco ISE API allows an authenticated remote attacker with administrative privileges to send crafted API requests that exploit insufficient input validation, resulting in SQL injection. Successful exploitation can disclose sensitive information such as hashed credentials. The vulnerability affects specific Cisco ISE versions 3.1.0 through 3.5.0. The CVSS 3.1 base score is 4.9, reflecting medium severity with network attack vector, low attack complexity, and high privileges required. No vendor advisory or patch information is provided in the input data.

An attacker with valid administrative credentials can exploit this vulnerability to access sensitive information on the affected device, including hashed credentials. This could potentially facilitate further attacks if the hashed credentials are cracked or reused. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious API activity. No official fix or workaround information is provided in the input data.