The vulnerability resides in the wapptunneld component of Akamai Guardicore Platform Agent before version 7.4 on macOS. It is caused by insufficient input validation when the service processes network interface names, allowing a local user who can rename interfaces to embed a malicious shell payload. When that user later triggers a “Log out from your IdP” action, the corrupted interface name is passed to system utilities, causing arbitrary command execution with root privileges. This provides a local privilege escalation path that could lead to full system compromise.

Affected are releases of Akamai Guardicore Platform Agent for macOS older than 7.4. All installations of the platform agent before that release are considered vulnerable due to the absence of a patched version before 7.4.

The CVSS score of 6.7 indicates moderate severity, and the EPSS score of 2% reflects a low but non‑negligible probability of exploitation. The vulnerability is not currently catalogued in CISA's KEV list. Exploitation requires a local user with permission to modify network interface names and an action that triggers a logout from the identity provider. Based on the description, the likely attack vector is local privilege escalation through command injection, with conditions that a privileged or even an unprivileged user can perform the network rename via System Settings.