Cisco License (Smart Software Manager) On-Prem Multiple Vulnerabilities (cisco-sa-ssm-access-nttb2dhE)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364455);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-20328",
    "CVE-2026-76454",
    "CVE-2026-76437",
    "CVE-2026-76452"
  );
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu54774");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwv53803");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwv53807");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwv53814");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ssm-access-nttb2dhE");
  script_xref(name:"IAVA", value:"2026-A-1090");

  script_name(english:"Cisco License (Smart Software Manager) On-Prem Multiple Vulnerabilities (cisco-sa-ssm-access-nttb2dhE)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) is
affected by multiple vulnerabilities, including:

  - A vulnerability in the web-based management interface of Cisco License On-Prem could allow an
    unauthenticated, remote attacker to gain unauthorized access to an affected application. This
    vulnerability is due to improper checks during the password reset process. A successful exploit could
    allow the attacker to reset the password of an arbitrary account, including high-privileged
    administrative user accounts. (CVE-2026-20328)

  - A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem could allow an
    unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an
    affected application. This vulnerability is due to improper input validation and a lack of authentication
    in the management API. (CVE-2026-76454)

  - A vulnerability in the web-based user interface of Cisco License On-Prem could allow an authenticated,
    remote attacker with valid administrative credentials to execute arbitrary commands on the underlying
    operating system with root privileges. This vulnerability is due to improper validation of user-supplied
    content within configurations that are submitted to the web-based management interface. (CVE-2026-76437)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?87fdffbe");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu54774");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv53803");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv53807");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv53814");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Cisco License On-Prem 10-202608 or later. Releases 9-202601 and earlier (Cisco Smart Software Manager
On-Prem) must migrate to a fixed Cisco License On-Prem release.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76454");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-20328");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(23, 78, 89, 862);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:smart_software_manager_on-prem");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_smart_software_manager_web_interface_detect.nbin");
  script_require_keys("installed_sw/Cisco Smart Software Manager On-Prem");

  exit(0);
}

include('vcf_extras.inc');

vcf::cisco_ssm::initialize();

var app_info = vcf::combined_get_app_info(app:'Cisco Smart Software Manager On-Prem');

var constraints = [
  {'fixed_version' : '10-202608'}
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  flags:{'sqli':TRUE}
);