Cisco SSM On-Prem bug lets hackers change any user's password

Cisco has fixed a maximum severity vulnerability that allows attackers to change any user's password on vulnerable Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers, including administrators.

The flaw also impacts SSM On-Prem installations earlier than Release 7.0, known as Cisco Smart Software Manager Satellite (SSM Satellite).

As a Cisco Smart Licensing component, SSM On-Prem assists service providers and Cisco partners in managing customer accounts and product licenses.

Tracked as CVE-2024-20419, this critical security flaw is caused by an unverified password change weakness in SSM On-Prem's authentication system. Successful exploitation enables unauthenticated, remote attackers to set new user passwords without knowing the original credentials.

"This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device," Cisco explained.

"A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user."

Cisco SSM On-Prem Release	First Fixed Release
8-202206 and earlier	8-202212
9	Not vulnerable

The company says that no workarounds are available for systems impacted by this security flaw, and all admins must upgrade to a fixed release to secure vulnerable servers in their environment.

Cisco's Product Security Incident Response Team (PSIRT) has yet to find evidence of public proof of concept exploits or exploitation attempts targeting this vulnerability.

Earlier this month, the company patched an NX-OS zero-day (CVE-2024-20399) that had been exploited to install previously unknown malware as root on vulnerable MDS and Nexus switches since April.

In April, Cisco also warned that a state-backed hacking group (tracked as UAT4356 and STORM-1849) had been exploiting two other zero-day bugs (CVE-2024-20353 and CVE-2024-20359).

Since November 2023, attackers have used the two bugs against Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls in a campaign dubbed ArcaneDoor, targeting government networks worldwide.