A flaw in Cisco ThousandEyes Enterprise Agent’s BrowserBot component permitted an authenticated, remote attacker to inject unvalidated command arguments, leading to arbitrary command execution inside the BrowserBot container as the node user. This flaw, an instance of operating system command injection (CWE‑78), could compromise the confidentiality, integrity, and availability of the affected system by allowing attackers to run malicious commands with the privileges of the BrowserBot process.

The vulnerability affects Cisco ThousandEyes Enterprise Agent, particularly the BrowserBot component used for synthesizing web transaction tests. All installations of the agent before the issued patch are potentially vulnerable; specific version details were not supplied in the advisory.

The problem carries a CVSS score of 6.3, indicating moderate severity, and has no recorded EPSS value or KEV listing. Exploitation requires valid ThousandEyes SaaS credentials with transaction‑test management rights, and the attack vector is remote, authenticated, via the SaaS interface. The risk is medium to high because an attacker who meets the prerequisites can execute arbitrary commands on the Agent host. Cisco has addressed this vulnerability, and no customer action is required.