A command injection flaw exists in the web-based management interface of Cisco IoT Field Network Director. Insufficient input validation allows an authenticated attacker with low‑privilege credentials to submit crafted input that results in arbitrary command execution in the device’s user EXEC environment, and the ability to create, read, or delete files. This gives the attacker code‑execution capability for commands limited to user EXEC mode, potentially enabling further compromise of the router or network.

Cisco believes the flaw impacts the Cisco IoT Field Network Director appliance. No specific firmware or software version information is provided in the advisory, so all installations of the device should be considered at risk until a patch is applied.

The vulnerability has a CVSS score of 6.4, reflecting moderate to high impact. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers must first authenticate to the web interface with low‑privilege credentials, a condition that is likely satisfied by many operational accounts. Once authenticated, the attacker can submit malicious input and achieve command injection. The likely attack vector is via the web-based management interface where an authenticated user submits crafted input.