The vulnerability allows code injection by exploiting insufficient validation of JWT claims (CWE-74) and enabling injection of executable statements (CWE-94) within ExchangeController.java of the sonic-agent component. The result is arbitrary code execution on the host running sonic-agent, which compromises confidentiality, integrity, and availability. The description indicates that the attack may be initiated remotely and that the exploit has been publicly disclosed.

SonicCloudOrg sonic‑agent versions up to and including 2.7.2 are affected. The flaw resides in the file sonic‑server‑controller/src/main/java/org/cloud/sonic/controller/controller/ExchangeController.java. These releases are no longer supported, and the vendor has not released a fix.

The CVSS score of 6.9 reflects moderate to high severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is remotely exploitable via the JWT Authentication Filter; a malicious actor can send a crafted request to the exchange endpoint to inject malicious code, which could lead to full system compromise. The likely attack vector is supplying a malicious JWT to the exchange endpoint, as inferred from the description of an authentication filter involved in the vulnerable request processing.