A flaw in the command‑line interface of Cisco Secure FTD Software allows an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. The vulnerability arises from insufficient validation of user‑supplied command arguments for a specific CLI command, making it a classic authenticated command injection that can be leveraged with valid administrative credentials. This is identified as CWE‑250, indicating elevation of privilege through improper input handling. Successful exploitation would give an attacker kernel‑level access, potentially compromising the device’s integrity, confidentiality, and availability.

The affected product is Cisco Secure Firewall Threat Defense (FTD) Software. No specific version range is listed in the advisory, so all deployed instances of this software that have not yet applied the published fix are considered vulnerable.

The base CVSS score of 6.0 places the vulnerability in the moderate range, and the EPSS score of less than 1% indicates a very low exploitation probability, with little evidence of widespread attacks. Because the attacker must first possess valid administrative credentials—either locally or remotely—the probability of a public exploit is limited. However, inside a compromised environment or for insiders with administrative access, the impact is severe, enabling complete system takeover. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation to date.