Cisco ThousandEyes Enterprise Agent exposes a command‑line interface that permits a local user with low privileges to overwrite arbitrary files on the device. The flaw arises from improper access controls on the local file system; by placing a symbolic link in a specific location and invoking the write operation through the CLI, an attacker can bypass file system permissions and replace target files, enabling modification or destruction of critical configuration or executable files.

Cisco ThousandEyes Enterprise Agent. All released versions are affected unless the vendor explicitly notes otherwise; no specific vulnerable versions are listed in the advisory, so any installed agent may be impacted.

The CVSS v3 score of 5.5 indicates moderate severity. Exploitation requires local, authenticated access to the device and the ability to run the agent’s CLI as a low‑privileged user. By creating a symbolic link pointing to an arbitrary path and triggering the vulnerable write command, the attacker can overwrite files on the local system. The advisory does not mention any public exploitation attempts, and the vulnerability is not listed in the CISA catalog of known exploited vulnerabilities. The EPSS metric is not available.