This vulnerability in Cisco Secure Firewall Management Center (FMC) arises from a critical API that does not enforce authentication. An unauthenticated remote attacker can exploit this by repeatedly calling the API to download sensitive files and fill disk space without restriction. The resulting impact includes unauthorized data access and potential denial of service due to resource exhaustion. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability but no impact on confidentiality or integrity. The affected versions are explicitly enumerated and include multiple 7.x and 10.x releases. No vendor advisory or patch information is provided, and no known active exploitation is reported.

An attacker can remotely exploit the unauthenticated API to download sensitive files that should be restricted, potentially exposing confidential information. Additionally, the attacker can consume unbounded disk space, causing the device to become unresponsive and resulting in a denial of service condition. There is no reported impact on confidentiality or integrity beyond unauthorized file access, but availability is significantly affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict network access to the affected API to trusted sources only and monitor for unusual API usage patterns to mitigate exploitation risk.