CVE-2024-20419 | A vulnerability in the authentication system of Cisco Smart … | CVSS 10.0 CRITICAL

Description

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.

Metadata

CVE ID: CVE-2024-20419
State: PUBLISHED
Assigner: cisco
Reserved: 2023-11-08 15:08 UTC
Published: 2024-07-17 16:27 UTC
Last updated: 2025-02-13 17:32 UTC
Primary CWE: CWE-620
Unverified Password Change
Vendor / Product: Cisco / Cisco Smart Software Manager On-Prem
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Cisco	Cisco Smart Software Manager On-Prem	—	8-202206

Weakness (CWE)

CWE	Source	Description
CWE-620	cna	Unverified Password Change

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)