CVE-2019-16029 Cisco Smart Software Manager On-Prem Web Interface Denial of Service Vulnerability

High 8.2 Published 26 Jan 2020 Updated 15 Nov 2024

Unauthenticated attackers can modify user account data via the API, causing denial of service or gaining administrator access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-16029?

CVE-2019-16029 is a high-severity missing authorization vulnerability in Cisco Smart Software Manager On-Prem, published on 26 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. The vulnerability is due to the lack of input validation in the API. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to change or corrupt user account information which could grant the attacker administrator access or prevent legitimate user access to the web interface, resulting in a denial of service (DoS) condition.

Weakness: CWE-20

Which versions are affected by CVE-2019-16029?

It affects 1 product.

Products include Cisco Smart Software Manager On-Prem.

How do I fix CVE-2019-16029?

No fix has been published for CVE-2019-16029 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-16029 being exploited?

There is no known exploitation of CVE-2019-16029 in the wild and no public exploit code.

Sources

Also known as GHSA-v2h7-ph6x-hrqm.