This vulnerability in Cisco Identity Services Engine Software (versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0) is caused by improper neutralization of special elements in SQL commands, enabling SQL injection attacks. An attacker with low-privileged administrative credentials can exploit this by sending crafted requests to the device, potentially allowing unauthorized reading or modification of database data. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.

Successful exploitation could allow an attacker to read or modify data in the underlying database of the Cisco Identity Services Engine, potentially compromising data integrity and confidentiality. The attacker must have at least low-privileged administrative credentials, limiting the attack surface to authenticated users with some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to administrative interfaces and monitor for suspicious activity from authenticated users with low privileges.