This vulnerability arises from improper neutralization of special elements in user input within the web-based management interface of Cisco ThousandEyes Virtual Appliance. An attacker with valid administrative credentials can save configuration details containing malicious values, leading to arbitrary OS command execution with root privileges. The CVSS 3.1 base score is 4.7, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker who is authenticated with administrative privileges can execute arbitrary operating system commands as root on the affected appliance. This could lead to partial compromise of system confidentiality, integrity, and availability. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since exploitation requires valid administrative credentials, ensure strong credential management and limit administrative access until a fix is available.