CVE-2024-20419

🗓️ 17 Jul 2024 16:27:35Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 291 Views🌐 WEB

Vulnerability in Cisco Smart Software Manager On-Prem authentication syste

Reporter	Title	Published	Views	Family All 20
BDU FSTEC	The vulnerability of the Cisco Smart Software Manager On-Premium software authentication system, which stems from the lack of necessary checks during password changes, allows attackers to gain access to the administration web interface.	23 Jul 202400:00	–	bdu_fstec
Circl	CVE-2024-20419	17 Jul 202419:53	–	circl
Cisco	Cisco Smart Software Manager On-Prem Password Change Vulnerability	17 Jul 202416:00	–	cisco
Tenable Nessus	Cisco Smart Software Manager On-Prem Password Change (cisco-sa-cssm-auth-sLw3uhUy)	9 Aug 202400:00	–	nessus
Tenable Nessus	Cisco Smart Software Manager On-Prem Password Change Vulnerability (CVE-2024-20419) (Direct Check)	8 Aug 202400:00	–	nessus
Cvelist	CVE-2024-20419	17 Jul 202416:27	–	cvelist
Exploit DB	Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover	10 Apr 202500:00	–	exploitdb
Metasploit	Cisco Smart Software Manager (SSM) On-Prem Account Takeover (CVE-2024-20419)	24 Sep 202418:53	–	metasploit
NCSC	Vulnerability fixed in Cisco Smart Software Manager On-Prem	19 Jul 202413:06	–	ncsc
Nuclei	Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover	31 Jul 202606:09	–	nuclei

NVD

Node

cisco smart_software_manager_on-premRange<8-202112

[
  {
    "vendor": "Cisco",
    "product": "Cisco Smart Software Manager On-Prem",
    "versions": [
      {
        "version": "8-202206",
        "status": "affected"
      }
    ]
  }
]

Source	Link
sec	www.sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy
secpod	www.secpod.com/blog/critical-flaw-in-ciscos-secure-email-gateways-allows-attackers-to-control-the-device-completely/

Parameter	Position	Path	Description	CWE
hostname	query param	backend/settings/oauth_adfs	Obtains XSRF token required for subsequent password reset; vulnerable flow enables unauthorized password changes.	CWE-620
uid	request body	backend/reset_password/generate_code	Generates an auth_token for password reset using the specified user, enabling password change	CWE-620
uid	request body	backend/reset_password	Resets the password for a user using an obtained auth_token; directly facilitates password takeover	CWE-620
auth_token	request body	backend/reset_password	Resets the password for a user using an obtained auth_token; directly facilitates password takeover	CWE-620
password	request body	backend/reset_password	Resets the password for a user using an obtained auth_token; directly facilitates password takeover	CWE-620
password_confirmation	request body	backend/reset_password	Resets the password for a user using an obtained auth_token; directly facilitates password takeover	CWE-620
username	request body	backend/auth/identity/callback	Authenticates with the new password to verify the takeover; confirms account compromise	CWE-620
password	request body	backend/auth/identity/callback	Authenticates with the new password to verify the takeover; confirms account compromise	CWE-620

17 Jun 2026 07:07Current

7.6High risk

Vulners AI Score7.6

CVSS 3.110

EPSS0.80635

SSVC