This vulnerability in Cisco Unified Intelligence Center arises from improper neutralization of special elements in SQL commands, enabling an authenticated local attacker to conduct blind SQL injection attacks via crafted requests to the web interface. The flaw stems from insufficient validation of user-supplied input. Successful exploitation allows reading of the internal database. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with valid credentials can exploit this vulnerability to read sensitive data from the internal database of the affected Cisco Unified Intelligence Center device. This could lead to unauthorized disclosure of confidential information. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor Cisco advisories for updates. Until a patch is available, restrict access to the management interface to trusted users and enforce strong credential management to reduce risk.