Exploit released for Cisco SSM bug allowing admin password changes

Cisco warns that exploit code is now available for a maximum severity vulnerability that lets attackers change any user password on unpatched Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers.

As a Cisco Smart Licensing component, Cisco SSM On-Prem helps manage accounts and product licenses on an organization's environment using a dedicated dashboard on the local network.

"The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory," the company warned on Wednesday.

However, Cisco has yet to find evidence of attackers exploiting this security flaw (tracked as CVE-2024-20419) in the wild.

CVE-2024-20419 is caused by an unverified password change weakness in SSM On-Prem's authentication system. This weakness lets unauthenticated attackers remotely change any user password (including those used for administrator accounts) without knowing the original credentials.

"This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device," Cisco explained in July when it released security updates to address the flaw.

"A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user."

No workarounds are available for impacted systems, and all admins must upgrade to a fixed release to secure vulnerable SSM On-Prem servers.

Last month, Cisco also patched a critical vulnerability that allows attackers to add new users with root privileges and permanently crash Security Email Gateway (SEG) appliances using emails with malicious attachments and fixed an NX-OS zero-day (CVE-2024-20399) that had been exploited in the wild since April to install previously unknown malware as root on vulnerable MDS and Nexus switches.

Today, CISA warned admins to disable the legacy Cisco Smart Install feature after seeing it abused in recent attacks to steal sensitive data like system configuration files.