This vulnerability arises from the lack of proper server-side validation of Administrator permissions in the web-based management interface of Cisco Identity Services Engine Software. An attacker who has valid Administrator credentials can exploit this by sending crafted HTTP requests to modify configuration elements, specifically file descriptions, on the affected system. The flaw affects versions 3.1.0 through 3.5.0 inclusive. The CVSS v3.1 base score is 4.3, reflecting low complexity and limited impact confined to integrity modification without affecting confidentiality or availability.

An attacker with valid Administrator credentials can modify configuration descriptions on the affected Cisco ISE device. This could lead to unauthorized changes in configuration metadata but does not impact confidentiality or availability. There is no indication of privilege escalation or remote unauthenticated exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Since the vulnerability requires valid Administrator credentials, ensure strict access controls and credential management. Monitor for vendor updates to apply official fixes when available.