The vulnerability enables an authenticated attacker to inject arbitrary operating‑system commands through the web‑based management API of Cisco Application Policy Infrastructure Controller. By sending specially crafted input after authenticating, the attacker can execute commands with root privileges, potentially compromising confidentiality, integrity, and availability of the device and the network it controls. The weakness arises from insufficient input validation of command arguments, corresponding to CWE‑544.

Cisco Application Policy Infrastructure Controller (APIC) is affected. No specific firmware or release numbers are listed in the advisory, so all versions of APIC remain potentially vulnerable until a patch is applied.

The vulnerability has a CVSS score of 6.5 and is not listed in the CISA KEV catalog. The EPSS score is not available, indicating no publicly known exploitation prevalence at the time of the advisory. To exploit the flaw, an attacker must first obtain valid administrative API credentials, implying the attack vector is authenticated, remote. Once authenticated, the attacker can deliver the payload and gain full root access to the underlying operating system. The lack of a publicly referenced exploit does not eliminate the risk, as the condition for exploitation is relatively low: only the requirement of administrative credentials and network access to the API endpoint.