Secuno
ENNL
Book demo

CVE-2024-20419

Cisco Smart Software Manager On-prem vulnerability

10.0 CRITICALEPSS 80.6%
  1. Published17 Jul 2024

Description

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Cisco Smart Software Manager On-prem< 8-202112

Remediation

Fixed in
Cisco Smart Software Manager On-prem≥ 8-202112

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-924678.3
zlt2000 microservices-platform through 6.0.0 contains an unverified password change…
CVE-2026-919959.1
pig before 4.1.0 contains an authentication bypass vulnerability in the…
CVE-2026-766338.1
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password…
CVE-2026-732928.3
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the…
CVE-2026-159649.8
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass…
CVE-2026-126929.8
Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform…

Frequently asked

Is CVE-2024-20419 being actively exploited?

CVE-2024-20419 is not in the CISA KEV catalog. Its EPSS exploit probability is 80.6%.

How severe is CVE-2024-20419?

CVE-2024-20419 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 80.6% probability of exploitation.

Which products are affected by CVE-2024-20419?

Affected products include Cisco Smart Software Manager On-prem.

How do I fix CVE-2024-20419?

Upgrade affected software to a fixed version, for example Cisco Smart Software Manager On-prem 8-202112 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-20419 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.