CVE-2024-20419 Auth bypass in Cisco Smart Software Manager On-Prem

Critical 10.0 Published 17 Jul 2024 Updated 13 Feb 2025

Unauthenticated remote attackers can change any user's password, including admins, via crafted HTTP requests, leading to full system compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-20419?

CVE-2024-20419 is a critical authentication bypass vulnerability in Cisco Smart Software Manager On-Prem, published on 17 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.

Weakness: CWE-620

Which versions are affected by CVE-2024-20419?

It affects 1 product.

Products include Cisco Smart Software Manager On-Prem.

How do I fix CVE-2024-20419?

No fix has been published for CVE-2024-20419 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-20419 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-20419 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 Nuclei template.

Sources

Also known as GHSA-5697-p67m-73p6.