The cisco_firesight_manager_ACL_rule_export module builds a shell script that authenticates to Cisco fireSIGHT Manager and calls its API. Configuration values (IP, login, password, domain and policy IDs) and MISP attributes (destination IPs, URLs, comments) are interpolated directly into single‑quoted shell assignments without any escaping. If an injected value contains a single quote, the shell string is broken, allowing arbitrary shell commands to be executed when the script is run. Attackers with the ability to submit MISP events or attributes can thus inject commands that run with the privileges of the analyst executing the script. The exploit could expose fireSIGHT Manager credentials, alter ACL rules, or compromise the analyst workstation. Additionally, an uninitialized variable could trigger a NameError, causing a denial of service when a payload lacks a config key.

The vulnerability affects the misp-modules component of the MISP platform, specifically the cisco_firesight_manager_ACL_rule_export module. The CVE does not enumerate specific version ranges; affected releases are any that use the unescaped shell‑script generation logic prior to the patch that introduces shlex.quote() and proper config initialization.

The CVSS score of 6.3 indicates a medium severity vulnerability. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to add a single‑quote character to an attribute value during event submission and rely on a legitimate analyst to execute the resulting script. While the exploitation requires the victim’s execution of the script, the opportunity exists whenever generated scripts are run, highlighting a potential insider or social‑engineering risk. Because the module only affects the generation phase, the attacker cannot alter the API calls directly, but successful shell command injection can still lead to compromise of credentials and system state.