CVE-2024-20419
"Cisco Smart Software Manager On-Prem Password Change Remote Authentication Bypass"
Description
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.
INFO
Published Date :
July 17, 2024, 5:15 p.m.
Last Modified :
Nov. 21, 2024, 8:52 a.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
6.0
Exploitability Score :
3.9
Public PoC/Exploit Available at Github
CVE-2024-20419 has a 1 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-20419.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2024-20419 - Cisco SSM On-Prem < Mass Password Reset Account Takeover Exploit
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-20419 vulnerability anywhere in the article.
-
Cybersecurity News
Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401 to Launch Malware Campaigns
Cybersecurity researchers at FortiGuard Labs have observed multiple campaigns targeting a critical vulnerability in GeoServer, an open-source geospatial data server. Identified as CVE-2024-36401, this ... Read more
-
Cybersecurity News
Red Hat Issues Critical Patch for Pulpcore Authentication Bypass Flaw (CVE-2024-7923)
Red Hat has issued a critical security advisory warning of an authentication bypass vulnerability (CVE-2024-7923) in Pulpcore, a content management system used in Red Hat Satellite deployments. The vu ... Read more
-
Cybersecurity News
CVE-2024-7012 (CVSS 9.8): Critical Foreman Flaw Exposes Red Hat Satellite to Unauthorized Access
A critical vulnerability, CVE-2024-7012, has been discovered in Foreman, a widely used open-source lifecycle management tool. This authentication bypass flaw, with a CVSS score of 9.8 (the highest sev ... Read more
-
Cybersecurity News
CVE-2024-20017 (CVSS 9.8): Zero-Click Exploit Discovered in Popular Wi-Fi Chipsets, PoC Published
Image: HyprdudeSecurity researcher Hyprdude has published detailed information and a proof-of-concept (PoC) exploit for a critical vulnerability identified as CVE-2024-20017. With a CVSS score of 9.8, ... Read more
-
Cybersecurity News
North Korea Targets DeFi and Crypto Companies with Advanced Social Engineering Attacks
Please enable JavaScriptThe FBI has warned sternly about North Korean state-sponsored hackers employing highly sophisticated social engineering tactics to infiltrate decentralized finance (DeFi) and c ... Read more
-
BleepingComputer
Cisco warns of backdoor admin account in Smart Licensing Utility
Cisco has removed a backdoor account in the Cisco Smart Licensing Utility (CSLU) that can be used to log into unpatched systems with administrative privileges. CSLU is a Windows application that helps ... Read more
-
Cybersecurity News
CVE-2024-38106: 0-Day Windows Kernel Vulnerability Exploited in the Wild, PoC Published
Recently, security researcher Sergey Kornienko from PixiePoint Security published an analysis and proof-of-concept (PoC) exploit for a critical zero-day vulnerability in the Windows Kernel, identified ... Read more
-
Cybersecurity News
Researcher Identifies ToddyCat-Inspired APT Attack Leveraging ICMP Backdoor and Microsoft Exchange Flaws
Image: KasperskyCybersecurity researchers at Kaspersky’s Global Emergency Response Team (GERT) have uncovered a sophisticated attack involving an ICMP backdoor, bearing striking similarities to the ta ... Read more
-
Cybersecurity News
CVE-2024-7261 (CVSS 9.8): Zyxel Patches Critical Vulnerability in Wi-Fi Devices
Zyxel, a prominent networking equipment manufacturer, has issued a security advisory urging users to promptly update their firmware to address a critical vulnerability affecting a range of their acces ... Read more
-
Cybersecurity News
Google TAG Uncovers Watering Hole Attacks on Mongolian Government Websites
In a revealing report, Google’s Threat Analysis Group (TAG) has uncovered a series of sophisticated watering hole attacks targeting Mongolian government websites between November 2023 and July 2024. T ... Read more
-
Cybersecurity News
Critical Flaw Discovered in Popular Python Library Pandas
Information Stealer Malware on the Rise: ACSC Issues Urgent Cybersecurity WarningThe Australian Cyber Security Centre (ACSC) has issued a warning about the escalating threat of information stealer mal ... Read more
-
Cybersecurity News
Critical Vulnerability Found in Flatpak: CVE-2024-42472 (CVSS 10) Exposes Files Outside Sandbox
Please enable JavaScriptA serious security flaw has been discovered in Flatpak, a popular system for distributing and running sandboxed desktop applications on Linux. The vulnerability, tracked as CVE ... Read more
-
Cybersecurity News
CVE-2024-39825 and CVE-2024-39818: High-Risk Zoom Flaws Require Urgent Updates
Zoom has released a security bulletin addressing several vulnerabilities in its Workplace Apps and Rooms Clients, some of which pose significant security risks to users. Among the most critical are CV ... Read more
-
Cybersecurity News
Windows Users Beware: CVE-2024-6768 – New ‘Blue Screen of Death’ Vulnerability Affects All
A newly discovered vulnerability in the Windows operating system has raised concerns among cybersecurity experts due to its potential to trigger the infamous “Blue Screen of Death” (BSOD). Identified ... Read more
-
Cybersecurity News
CVE-2024-5651: RCE Vulnerability in Fence Agents Exposes Critical Infrastructure to Exploitation
A high-severity security vulnerability (CVE-2024-5651, CVSS 8.8) has been discovered in fence agents, a vital component of many enterprise storage environments. This flaw could enable remote code exec ... Read more
-
Cybersecurity News
CVE-2024-7589: OpenSSH Pre-Authentication Vulnerability in FreeBSD Exposes Systems to RCE
Please enable JavaScriptIn a recent security advisory, the FreeBSD Project disclosed a critical vulnerability (CVE-2024-7589) in OpenSSH, the widely-used implementation of the SSH protocol suite. This ... Read more
-
Cybersecurity News
PoC Exploit Releases for Cisco SSM On-Prem Account Takeover (CVE-2024-20419) Flaw
Image Credit: Mohammed AdelA critical vulnerability, identified as CVE-2024-20419, has been publicly disclosed by security researcher Mohammed Adel, who published a detailed writeup along with proof-o ... Read more
-
BleepingComputer
Exploit released for Cisco SSM bug allowing admin password changes
Cisco warns that exploit code is now available for a maximum severity vulnerability that lets attackers change any user password on unpatched Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) l ... Read more
-
Cybersecurity News
Cisco Warns of Public PoC Exploit Code of Critical CVE-2024-20419 (CVSS 10) Flaw
Cisco has recently updated its security advisory, alerting users to a critical vulnerability identified as CVE-2024-20419. This flaw affects the Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem ... Read more
-
Cyber Security News
Cisco Software Manager Password Change Vulnerability Let Hackers Change password
A critical vulnerability in Cisco’s Smart Software Manager On-Prem (SSM On-Prem) has surfaced, allowing unauthenticated, remote attackers to change user passwords, including those of administrative us ... Read more
-
Cybersecurity News
Warning: Fake WinRar Websites Distributing Malware
SonicWall has recently issued a cybersecurity alert about a deceptive website that mimics the official WinRar site. This fake site, win-rar.co, not only closely resembles the legitimate WinRar site bu ... Read more
-
The Cyber Express
Weekly Vulnerability Report: Cyble Urges Fixes in SolarWinds, Cisco, Ivanti & Microsoft
Cyble Research & Intelligence Labs (CRIL) researchers have analyzed more than 100 security vulnerabilities in the last two weeks, with flaws in IT products from SolarWinds, Cisco, Ivanti, Microsoft, E ... Read more
-
The Hacker News
Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager
Cisco has released patches to address a maximum-severity security flaw impacting Smart Software Manager On-Prem (Cisco SSM On-Prem) that could enable a remote, unauthenticated attacker to change the p ... Read more
The following table lists the changes that have been made to the
CVE-2024-20419 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy -
CVE Modified by [email protected]
Aug. 13, 2024
Action Type Old Value New Value Added Reference Cisco Systems, Inc. https://www.secpod.com/blog/critical-flaw-in-ciscos-secure-email-gateways-allows-attackers-to-control-the-device-completely/ [No types assigned] -
CVE Received by [email protected]
Jul. 17, 2024
Action Type Old Value New Value Added Description A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user. Added Reference Cisco Systems, Inc. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy [No types assigned] Added CWE Cisco Systems, Inc. CWE-620 Added CVSS V3.1 Cisco Systems, Inc. AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-20419 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-20419
weaknesses.