{"id":"CVE-2024-20419","published":"2024-07-17T16:27:35Z","modified":"2025-02-13T17:32:31Z","title":"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an…","vendor":"Cisco","product":"Cisco Smart Software Manager On-Prem","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cisco","product":"Cisco Smart Software Manager On-Prem","versions":["8-202206"]}],"description":{"text":"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.\r\n\r This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) stems from improper implementation of the password-change process. An unauthenticated remote attacker can send crafted HTTP requests to an affected device to change the password of any user, including administrative users, and then access the web UI or API with that user's privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:47Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.80917,"percentile":0.99628,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-17","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"Lost in the Fog: A New Ransomware Threat - Arctic Wolf","url":"https://otx.alienvault.com/pulse/66b014f647ffb47ce39c71ff","created":"2024-08-04"}],"provenance":"machine"},"cwes":[{"id":"CWE-620","name":"Unverified Password Change"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy","tags":[]},{"url":"https://www.secpod.com/blog/critical-flaw-in-ciscos-secure-email-gateways-allows-attackers-to-control-the-device-completely/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-18134","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-18134","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52155,"url":"https://www.exploit-db.com/exploits/52155","title":"Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover","type":"webapps","platform":"multiple","date":"2025-04-10","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-04-10"},"metasploit":[{"name":"Cisco Smart Software Manager (SSM) On-Prem Account Takeover (CVE-2024-20419)","module":"auxiliary/admin/http/cisco_ssm_onprem_account","type":"auxiliary","disclosureDate":"2024-07-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ssm_onprem_account.rb"}],"nuclei":[{"id":"CVE-2024-20419","name":"Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover","severity":"critical","path":"http/cves/2024/CVE-2024-20419.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20419.yaml"}],"first":{"date":"2024-07-20","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ssm_onprem_account.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-07-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-20419","provenance":"source"},{"date":"2024-07-20","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2025-04-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cisco_ssm_onprem_account.rb","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":68.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 378 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9963"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}