Vulnerability in Cisco Smart Software Manager lets attackers change any user password

Cisco on Wednesday disclosed a maximum-security vulnerability that enables distant menace actors with no authentication to vary the password of any consumer, together with these of directors with accounts, on Cisco Sensible Software program Supervisor On-Prem units.

The Cisco Sensible Software program Supervisor On-Prem resides contained in the buyer premises and gives a dashboard for managing licenses for all Cisco gear in use. It’s utilized by clients who can’t or don’t need to handle licenses within the cloud, as is extra frequent.

In a bulletin, Cisco warns that the product comprises a vulnerability that enables hackers to vary any account’s password. The severity of the vulnerability, tracked as CVE-2024-20419, is rated 10, the utmost rating.

“This vulnerability is because of improper implementation of the password-change course of,” the Cisco bulletin said. “An attacker might exploit this vulnerability by sending crafted HTTP requests to an affected system. A profitable exploit might enable an attacker to entry the online UI or API with the privileges of the compromised consumer.”

There aren’t any workarounds accessible to mitigate the menace.

It’s unclear exactly what an attacker can do after gaining administrative management over the system. One risk is that the online consumer interface and utility programming interface the attacker positive aspects administrative management over make it doable to pivot to different Cisco units related to the identical community and, from there, steal information, encrypt information, or carry out comparable actions. Cisco representatives didn’t instantly reply to an e mail. This put up will likely be up to date if a response comes later.

A safety replace linked to the bulletin fixes the vulnerability. Cisco stated it isn’t conscious of any proof that the vulnerability is being actively exploited.