<\/div>\n

A vulnerability in Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers allows threat actors to change any user’s password.<\/h2>\n\n\n\n

Cisco has addressed a critical vulnerability, tracked as CVE-2024-20419 (CVSS score of 10.0), in Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers that allows attackers to change any user’s password.<\/p>\n\n\n\n

The issue is due to an improper implementation in the password-change process. Threat actors can trigger the vulnerability by sending specially crafted HTTP requests to vulnerable devices. <\/p>\n\n\n\n

“A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.” reads the advisory<\/strong><\/a> published by the IT giant. “This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.”<\/em><\/p>\n\n\n\n

The security researcher Mohammed Adel discovered this vulnerability. <\/p>\n\n\n\n

The vulnerability impacts Cisco SSM On-Prem (aka Cisco Smart Software Manager Satellite (SSM Satellite)) versions earlier than Release 7.0.<\/p>\n\n\n\n

Cisco’s Product Security Incident Response Team (PSIRT) is not aware of any public announcements or attacks exploiting the CVE-2024-20419 vulnerability.<\/gwmw><\/p>\n\n\n\n

The advisory states that there is no workaround for this flaw.<\/p>\n\n\n\n

Pierluigi\u00a0Paganini<\/strong><\/a><\/p>\n\n\n\n

Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n

(<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking, Cisco<\/a>)<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

A vulnerability in Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers allows threat actors to change any user’s password. Cisco has addressed a critical vulnerability, tracked as CVE-2024-20419 (CVSS score of 10.0), in Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers that allows attackers to change any user’s password. The issue […]<\/p>\n","protected":false},"author":1,"featured_media":26713,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,55],"tags":[1671,15228,4112,9508,9506,10918,687,841,1533],"class_list":["post-165848","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-security","tag-cisco","tag-cisco-ssm-on-prem","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-pierluigi-paganini","tag-security-affairs","tag-security-news"],"yoast_head":"\n