CVE-2024-20419
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including adminis
Severity
Critical 10
CVSS 3.1
Exploited
Not listed
EPSS
0.806
99.6th percentile
Discovered by
Third party
Published by the vendor
Published
Jul 17, 2024
Assigned by cisco
Description
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.
Weakness: CWE-620
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Smart Software Manager On-Prem | Network & Security Management | cna-assigner |
Vendor-reported affected versions (2)
- Cisco · Cisco Smart Software Manager On-Prem
- cisco · smart_software_manager_on-prem