Critical severity10.0NVD Advisory· Published Jul 17, 2024· Updated Jun 17, 2026

CVE-2024-20419

Description

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cisco Systems, Inc./Smart Software Manager On Premllm-fuzzy3 versions
(expand)+ 2 more
- (no CPE)
- cpe:2.3:a:cisco:smart_software_manager_on-prem:*:*:*:*:*:*:*:*range: <8-202112
- (no CPE)range: 8-202206
Cisco Systems, Inc./SSM On-Premllm-create

Patches

Vulnerability mechanics

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUynvdVendor Advisory
www.secpod.com/blog/critical-flaw-in-ciscos-secure-email-gateways-allows-attackers-to-control-the-device-completely/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.065
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000