EUVD-2026-81117
GHSA-gvrw-xc72-49qh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Admin-only web UI gives PR:H over network with low complexity; injection yields root OS execution, a full host compromise, so C/I/A:H - exceeding the vendor's C:L/I:L/A:L.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands.
This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by saving configuration details that contain malicious values. A successful exploit could allow the attacker to execute arbitrary operating system commands with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials.
AnalysisAI
Command injection in the web-based management interface of Cisco ThousandEyes Virtual Appliance allows an authenticated remote attacker with valid administrative credentials to save configuration details containing malicious values, leading to arbitrary OS command execution as root. Affected Cisco ThousandEyes Enterprise Agent versions per EUVD include 4.0, 4.1, 4.2, 4.4.2, 4.4.3, 4.4.4, 5.0, 5.1, 5.1.2, 5.1.3, and 5.2.0, and the primary limitation is the PR:H requirement for admin access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid administrative credentials for the ThousandEyes Virtual Appliance web-based management interface (PR:H) - this is the primary limiting factor and restricts exploitation to already-trusted or credential-compromised operators. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but low-urgency issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed software release identified by Cisco's advisory for Cisco ThousandEyes Virtual Appliance/Enterprise Agent (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-teva-os-command-W4GAO6jp); the input data does not specify an exact patched version, so confirm the appropriate version from the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance lets an authenticated administ
Command injection in the BrowserBot component of Cisco ThousandEyes Enterprise Agent (CWE-78) allows authenticated SaaS
Local file overwrite in Cisco ThousandEyes Enterprise Agent allows authenticated, low-privileged CLI users to overwrite
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today