Summary: Cisco has issued a warning regarding a critical vulnerability (CVE-2024-20419) in its Smart Software Manager On-Prem license servers that allows unauthenticated attackers to change any user password remotely. Although exploit code is available, Cisco has not yet observed any active exploitation of this vulnerability in the wild.
Threat Actor: Unidentified | Unidentified
Victim: Cisco | Cisco
Key Point :
- Vulnerability allows attackers to change any user password without knowing original credentials.
- Exploitation requires sending crafted HTTP requests to the affected device.
- No workarounds exist; administrators must upgrade to secure their systems.
- Related vulnerabilities in Cisco products have also been patched recently.
- CISA has advised disabling the legacy Cisco Smart Install feature due to recent data theft incidents.
Cisco warns that exploit code is now available for a maximum severity vulnerability that lets attackers change any user password on unpatched Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers.
As a Cisco Smart Licensing component, Cisco SSM On-Prem helps manage accounts and product licenses on an organization’s environment using a dedicated dashboard on the local network.
“The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory,” the company warned on Wednesday.
However, Cisco has yet to find evidence of attackers exploiting this security flaw (tracked as CVE-2024-20419) in the wild.
CVE-2024-20419 is caused by an unverified password change weakness in SSM On-Prem’s authentication system. This weakness lets unauthenticated attackers remotely change any user password (including those used for administrator accounts) without knowing the original credentials.
“This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device,” Cisco explained in July when it released security updates to address the flaw.
“A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.”
No workarounds are available for impacted systems, and all admins must upgrade to a fixed release to secure vulnerable SSM On-Prem servers.
Last month, Cisco also patched a critical vulnerability that allows attackers to add new users with root privileges and permanently crash Security Email Gateway (SEG) appliances using emails with malicious attachments and fixed an NX-OS zero-day (CVE-2024-20399) that had been exploited in the wild since April to install previously unknown malware as root on vulnerable MDS and Nexus switches.
Today, CISA warned admins to disable the legacy Cisco Smart Install feature after seeing it abused in recent attacks to steal sensitive data like system configuration files.