CVE-2024-20419: vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users
This Cisco advisory covers CVE-2024-20419 in Smart Software Manager On-Prem.
- CVE-2024-20419
Key facts
- Vendor rating
- Critical, CVSS 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H· base score 10, scored by ciscoAttack vector: network. Attack complexity: low. Privileges required: none. User interaction: none. Scope: changed. Confidentiality impact: high. Integrity impact: high. Availability impact: high.- Weakness
- CWE-620 Unverified Password Change
- CISA SSVC
- Exploitation: none observed. Automatable: yes. Technical impact: total. CISA, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Scope: This vulnerability affects Cisco SSM On-Prem and Cisco Smart Software Manager Satellite (SSM Satellite).; Release 8-202206 and earlier (first fixed: 8-202212)
- Fixed in
- 8-202212
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
An unauthenticated remote attacker could exploit a flaw in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) to change the password of any user, including administrative users. The flaw is caused by improper implementation of the password-change process.
Text from the source record.
- Scope: This vulnerability affects Cisco SSM On-Prem and Cisco Smart Software Manager Satellite (SSM Satellite).
- Release 8-202206 and earlier (first fixed: 8-202212)
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2024-20419
Upgrade to a fixed release named by Cisco:
- 8-202212
Vendor guidance
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Release 8-202206 and earlier: upgrade to 8-202212.
Workaround status
- There are no workarounds that address this vulnerability.
More Cisco advisories
CVE-2026-20151Apr 1, 2026Cisco Smart Software Manager On-Prem Privilege Escalation VulnerabilityCVE-2026-20160Apr 1, 2026Cisco Smart Software Manager On-Prem Arbitrary Command Execution VulnerabilityCVE-2026-76506Nov 4, 2026Cisco UCS Central Software Remote Code Execution VulnerabilityCVE-2026-20241Nov 4, 2026Cisco Identity Services Engine Authorization Bypass VulnerabilityCVE-2026-76419Nov 4, 2026Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCVE-2026-76418Oct 28, 2026Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
Get an email when Cisco publishes the next one.
See Cisco's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
