Cisco, the largest provider of networking equipment in the world, disclosed a critical vulnerability in its Cisco Smart Software Manager On-Prem (SSM On-Prem) license servers on Wednesday.
The vulnerability allows an unauthenticated, remote attacker to change the password of any user, including administrative users.
The critical vulnerability tracked as CVE-2024-20419 (CVSS score: 10) results from improper implementation of the password-change process within the Cisco SSM On-Prem authentication system.
An attacker can exploit this vulnerability by sending crafted HTTP requests to an affected device.
Successful exploitation of this flaw enables an attacker to access the web UI or API with the privileges of the compromised user, potentially leading to unauthorized administrative control over the device.
This vulnerability affects Cisco SSM On-Prem and Cisco Smart Software Manager Satellite (SSM Satellite). For releases earlier than Release 7.0, this product was known as Cisco SSM Satellite. As of Release 7.0, this product is called Cisco SSM On-Prem.
Cisco says thatย no workarounds are available to address this vulnerability. To mitigate the risk, all admins are advised to upgrade to an appropriateย fixed software release, as indicated in the table below.
| Cisco SSM On-Prem Release | First Fixed Release |
| 8-202206 and earlier | 8-202212 |
| 9 | Not vulnerable |
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability, as it has yet to find any evidence that the flaw is being actively exploited.
Cisco has also confirmed that this vulnerability does not affect the Cisco Smart Licensing Utility.
Customers with service contracts that permit them to regular software updates should obtain security fixes through their usual update channels.
Those who do not have service contracts, can contact the Technical Assistance Center (TAC) for help in obtaining the necessary upgrades.
