A flaw in the network driver of Cisco Terminal Services Agent incorrectly maps network connections to user accounts, allowing an authenticated attacker to inherit another user's firewall rules. This leads to unauthorized network traffic being permitted, effectively bypassing the intended security controls. The weakness is a classic case of incorrect privilege management, classified as CWE-266.

Cisco has identified the Cisco Terminal Services Agent as the affected product. The specific versions are not disclosed in the advisory, so all installations of the TS Agent that include the vulnerable network driver should be considered at risk until a patched version is deployed.

The vulnerability carries a CVSS score of 5, indicating medium risk. Because the exploit requires user‑level credentials and remote delivery of crafted traffic, the likelihood of exploitation depends on the presence of accounts with at least user privileges and network access to the device. No EPSS score is available and the issue is not listed in CISA KEV, implying no confirmed public exploitation yet. Nonetheless, the potential to invalidate firewall controls warrants immediate attention.