Based on the description, a flaw in the lockdown enforcement of Cisco Secure Firewall Management Center permits an authenticated local attacker with administrative rights to inject arbitrary commands via the system CLI, potentially executing code as root even while the firewall is in lockdown mode. This locally privileged command injection can compromise the entire device, allowing attackers to modify configuration, exfiltrate data, or pivot further within the network.

Based on the advisory, the vulnerability affects all Cisco Secure Firewall Management Center (FMC) deployments. Since specific affected versions are not listed, all released FMC software should be considered at risk until a patch is applied.

The CVSS score of 6.0 denotes moderate severity, while the EPSS of less than 1 percent indicates a low likelihood of widespread exploitation at this time. Based on the description, the attacker must have valid administrative credentials and can run commands as root, which would have severe impact. The vulnerability is not listed in the CISA KEV catalog. Based on its local privilege escalation capability, it is inferred that organizations should treat it as high‑priority.