This vulnerability involves improper limitation of a pathname to a restricted directory (path traversal) in Cisco Identity Services Engine Software versions 3.1.0 through 3.5.0. An authenticated remote attacker with administrative privileges can exploit insufficient validation of user-supplied input in HTTP requests to execute arbitrary commands on the underlying operating system. Successful exploitation results in privilege escalation to root and can cause denial of service in single-node deployments by disrupting network access for unauthenticated endpoints until the node is restored.

An attacker with administrative credentials can execute arbitrary OS commands, escalate privileges to root, and cause denial of service in single-node deployments. This can disrupt network access for unauthenticated endpoints until the affected node is restored, impacting network availability and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict administrative access and monitor for suspicious activity involving crafted HTTP requests.