The vulnerability involves incorrect permission assignments classified under CWE-732. This flaw allows an attacker to gain unauthorized access or elevate privileges, potentially enabling execution of actions that the system is not meant to allow. The impact is a breach of integrity and confidentiality for the affected systems.

Cisco TelePresence Video Communication Server (VCS) Expressway is affected. No specific version range is listed, so all instances of this product should be reviewed for the presence of the hardening release.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly described; it is inferred that exploitation may involve manipulation of configuration files or privileged interfaces that rely on permission settings.