CVE-2024-20419: Cisco Smart Software Manager On-Prem Password Change Vulnerability
Critical vulnerability in Cisco Smart Software Manager On-Prem exposes systems to unauthorized password changes, exploit code now available.
Background
On July 17, 2024, Cisco published an advisory for a critical vulnerability in Cisco’s Smart Software Manager On-Prem (SSM On-Prem):
| CVE | Description | CVSSv3 |
|---|---|---|
| CVE-2024-20419 | Cisco Smart Software Manager On-Prem Password Change Vulnerability | 10 |
Analysis
CVE-2024-20419 is an unverified password change weakness within the Cisco SSM On-Prem interface due to improper validation. Specifically, the flaw allows an unauthenticated, remote attacker to exploit an insufficient authentication mechanism, changing the password of any user by sending specially crafted HTTP requests without prior knowledge of the existing password. The vulnerability affects Cisco SSM On-Prem version 8-202206 and earlier, including releases prior to 7.0 where the product was named Cisco SSM Satellite.
Successful exploitation could result in access to the web interface or API of Cisco SSM On-Prem in the context of the compromised user account. The vulnerability is considered critical as the complexity of the attack is low and could lead to full administrative control over the SSM On-Prem instance. This control could be used to disrupt the organization's software management processes, gain unauthorized access to sensitive resources and potentially carry out further attacks within the network.
On August 7, 2024, Cisco updated their advisory to reflect that public proof-of-concept (PoC) exploit code was now available, heightening the urgency to patch.
Proof of concept
On July 20, 2024, Mohammed Adel, a penetration tester with a previous history of developing exploits, published a detailed writeup explaining the root cause of the vulnerability and his PoC exploit code. The writeup also visually demonstrates the PoC being leveraged against an administrative account to change the password highlighting the vulnerabilities ease of exploitation.
Credit: Mohammeds writeup
Solution
Cisco has issued patches for all affected versions of Cisco SSM On-Prem. At the time of this blog there is no indication of exploitation in-the-wild, but with exploit code publicly available, administrators are strongly advised to apply these patches without delay to mitigate the risk of exploitation. The following table reflects affected and patched versions:
| Affected Versions | Patched Version |
|---|---|
| 8-202206 and earlier | 8-202212 |
| 9 | Not Vulnerable |
Cisco has highlighted that there are no workarounds for this vulnerability.
Identifying affected systems
A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2024-20419 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.
Get more information
- Security Advisory: Cisco Smart Software Manager On-Prem Password Change Vulnerability
- Mohammed Adel Blog: Cisco SSM On-Prem; Account Takeover (CVE-2024-20419)
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Related Articles
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
August 13, 2024Microsoft addresses 88 CVEs with seven critical vulnerabilities and 10 zero-day vulnerabilities, six of which were exploited in the wild.
Detecting Risky Third-party Drivers on Windows Assets
August 7, 2024Kernel-mode drivers are critical yet risky components of the Windows operating system. Learn about their functionality, the dangers they pose, and how Tenable's new plugins can help identify and mitigate vulnerabilities using community-driven resources like LOLDrivers.
Securing the AI Attack Surface: Separating the Unknown from the Well Understood
August 7, 2024There's a lot of confusion and unknowns regarding AI application risks, and a lot of vendors are trying to offer solutions to problems that aren't clearly defined. In this blog we explain why a smart approach is to start by focusing on basic, foundational cyber hygiene, adopt well-established best practices and enforce common-sense usage policies.
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
August 13, 2024Microsoft addresses 88 CVEs with seven critical vulnerabilities and 10 zero-day vulnerabilities, six of which were exploited in the wild.
Compromising Microsoft's AI Healthcare Chatbot Service
August 13, 2024Tenable Research discovered multiple privilege-escalation issues in the Azure Health Bot Service via a server-side request forgery (SSRF), which allowed researchers access to cross-tenant resources.
Cybersecurity Snapshot: New Report Ranks Top Cloud Threats, while CISA Guide Helps Assess Security of Software Products
August 9, 2024The Cloud Security Alliance has released its list of top cloud threats for 2024. Plus, CISA and the FBI published a guide for determining if a software product was built ‘secure by design.’ Meanwhile, find out how AI can transform offensive security. And get the latest on the Royal ransomware gang, the CIS Benchmarks and TikTok’s legal troubles!
- Exposure Management
- Vulnerability Management
- Exposure Management
- Vulnerability Management