The read‑only maintenance shell of Cisco Intersight Virtual Appliance contains improperly set file permissions that let an authenticated local administrator edit configuration files for system accounts. By modifying these files the attacker can grant themselves root rights. A successful exploit would give the attacker full control over the appliance, enabling access to sensitive data, alteration of workloads and configurations, and potential denial‑of‑service conditions.

The vulnerability affects Cisco Intersight Virtual Appliance; no specific version range is listed, so all releases that include the maintenance shell are potentially impacted.

The vulnerability has a CVSS score of 6.0, indicating moderate severity. EPSS shows a probability of exploitation below 1 %, suggesting that the risk in the wild is currently low. It is not listed in the CISA KEV catalog. The exploit requires the attacker to have local authenticated administrative access to the appliance, after which they can manipulate files within the maintenance shell to elevate to root.