This vulnerability in Cisco Crosswork Network Change Automation is due to improper neutralization of special elements in output used by a downstream component, specifically in the configuration template engine of the web interface. An authenticated attacker with template user write permissions can send crafted requests that lead to arbitrary command execution on the underlying OS, limited to areas where the template user has write permissions. The CVSS 3.1 score is 6.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

An attacker who has valid template user credentials with write permissions can execute arbitrary commands on the underlying operating system in limited file system areas. This could lead to partial compromise of the system's confidentiality, integrity, and availability. Users with only read permissions are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict template user write permissions to trusted administrators only and monitor for suspicious activity. No official remediation level or patch links are provided in the current data.