The vulnerability allows a remote authenticated attacker to execute arbitrary system commands on the underlying OS. This command injection flaw arises from insufficient validation of user-supplied configuration data in the web-based interface. Once exploited, the attacker obtains root privileges, which can be used to shut down the system or alter critical settings.

Affected systems are Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem, used internally in many organizations. The CVE list does not specify limited versions, so any deployed instance running the unmanaged web interface is potentially impacted.

The CVSS score of 4.9 indicates moderate severity. EPSS is unavailable, and the vulnerability is not listed in CISA KEV. The exploit requires the attacker to already hold administrative credentials, so the risk is confined to environments where privileged accounts are compromised or mismanaged. Attackers that gain admin access can then run arbitrary commands with root level privileges, providing complete control over the host.