The vulnerability resides in the command line interface of Cisco Secure FTD Software, where insufficient validation of CLI command arguments permits an authenticated, local user to inject arbitrary commands that are executed on the device’s underlying operating system with root privileges. An attacker must have valid administrative credentials to exploit this flaw. The CVE description identifies the risk of executing arbitrary commands as root on the device, which could compromise the device’s confidentiality, integrity, and availability.

Affected systems include Cisco Secure Firewall Threat Defense (FTD) Software installations. No specific version range is disclosed in the advisory, so all deployed FTD installations that have not applied any subsequent patch are potentially vulnerable. Administrators should verify whether their devices are running the affected build and check the vendor’s portal for the latest firmware or software update that remediates the issue.

The advisory assigns a medium CVSS score of 6.0 and an EPSS probability of less than 1 %, indicating a relatively low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, because an attacker must first obtain administrative credentials, the threat is confined to privileged users or to situations where credentials can be compromised. If successful, the attacker can command the operating system as root, which carries a high impact on confidentiality, integrity, and availability of the network defended by the device.