This vulnerability in Cisco BroadWorks CommPilot Application Software arises from missing authorization checks in the web-based management interface. An attacker with low-level authentication can exploit this by sending crafted HTTP requests to alter configurations on affected devices. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but high integrity impact. The affected versions explicitly include 21.0, 21.sp1, 22.0, 23.0, 24.0, 25.0, and 26.0.

Successful exploitation allows an authenticated attacker with low privileges to modify configuration settings on the affected Cisco BroadWorks devices. This impacts the integrity of the system configurations but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Cisco advisories for updates. Until a fix is available, restrict access to the management interface to trusted users and networks to reduce risk.