This vulnerability arises from incorrect use of privileged APIs in Cisco Catalyst SD-WAN Manager, enabling an authenticated attacker with read-only API access to upload malicious files and overwrite arbitrary files on the local file system. The flaw is due to improper file handling in the API interface, potentially escalating privileges to the vmanage user. The CVSS 3.1 base score is 5.4 (medium severity) with attack vector network, low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impact.

An attacker with valid read-only API credentials can overwrite arbitrary files on the affected system, potentially gaining elevated privileges as the vmanage user. This could compromise the integrity of the system and its configuration. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor Cisco advisories for updates. Until a fix is available, restrict API access to trusted users and consider additional access controls to limit exposure.