Cisco Smart Software Manager On-Prem Password Change Vulnerability [CVE-2024-20419]
CVE number = CVE-2024-20419
CVSS Score = 10
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.
This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.
Cisco has released software updates that address this vulnerability.
This vulnerability affects Cisco SSM On-Prem and Cisco Smart Software Manager Satellite (SSM Satellite).
Note: Cisco SSM On-Prem and Cisco SSM Satellite are the same product. For releases earlier than Release 7.0, this product was called Cisco SSM Satellite. As of Release 7.0, this product is called Cisco SSM On-Prem.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.