This vulnerability in Cisco ISE Software affects versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It is caused by improper restriction of names for files and other resources, leading to insufficient validation of user input. An attacker with valid administrative credentials can exploit this by sending a crafted HTTP request to gain write access on the underlying operating system. Cisco assigned a Security Impact Rating of High because the privilege gained can be easily escalated to root. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An authenticated attacker with administrative privileges can exploit this vulnerability to gain write access to the underlying operating system of the affected Cisco ISE device. This write access can be escalated to root privileges, potentially allowing full control over the system. There is no direct confidentiality or availability impact reported, but the integrity of the system is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires valid administrative credentials, ensure that administrative access is tightly controlled and monitored. Follow Cisco's official advisories for updates and apply any provided patches or workarounds as soon as they become available.