CVE-2024-20419

Cisco SSM On-Prem (Cisco Smart Software Manager On‑Prem) suffers an authentication weakness in the password-change flow. Affected versions are reported as

CVE-2022-20939

CVE-2022-20939 refers to a privilege-escalation vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) via the web-based management interface. The root cause is inadequate protection of sensitive user information, enabling an authenticated, remote attacker to access certain logs and ...

CVE-2019-16029

CVE-2019-16029 describes a vulnerability in the API of Cisco Smart Software Manager On-Prem Web Interface where an unauthenticated attacker can send crafted HTTP requests to exploit input validation flaws, potentially changing or corrupting user account information and causing a denial of service...

CVE-2022-20808

CVE-2022-20808 affects Cisco Smart Software Manager On-Prem (SSM On-Prem). The issue is a DoS caused by incorrect handling of multiple simultaneous device registrations, exploitable by an authenticated remote attacker sending multiple registration requests. The impact is an affected device experi...

CVE-2023-20110

CVE-2023-20110 affects Cisco Smart Software Manager On-Prem (SSM On-Prem). The web-based management interface fails to validate input, enabling an authenticated, low-privilege remote attacker to perform SQL injection and read data from the underlying database. Cisco and CNVD entries confirm the v...

CVE-2026-20160

Cisco Smart Software Manager On-Prem (SSM On-Prem) is affected by CVE-2026-20160 due to an unintended exposure of an internal service. An unauthenticated, remote attacker could send a crafted request to the exposed service API and execute commands on the underlying OS with root-level privileges. ...

CVE-2021-1219

Cisco Smart Software Manager Satellite (CSSM) contains a local, authenticated vulnerability due to insufficient protection of static credentials. The issue enables an authenticated, local attacker to view static credentials stored on the device, potentially facilitating further compromise. Affect...

CVE-2020-3245

The CVE-2020-3245 issue affects Cisco Smart Software Manager On-Prem (SSM On-Prem) in its web application. A lack of authorization controls allows an unauthenticated, remote attacker to craft HTTP requests that add arbitrary user accounts to the device configuration (these will not be admin or op...

CVE-2020-3158

Cisco Smart Software Manager On-Prem HA service contains a default, static password for a system account not controlled by the admin, enabling unauthenticated remote access to a sensitive part of the system with high privileges. Successful exploits could grant read/write access to system data, in...

CVE-2021-1218

Cisco Smart Software Manager Satellite's web management interface is affected by an open redirect vulnerability due to improper input validation of URL parameters in an HTTP request. An authenticated, remote attacker could craft a request to redirect a user to a malicious website. Cisco reports t...

CVE-2021-1222

CVE-2021-1222 describes a SQL injection in the web-based management interface of Cisco Smart Software Manager Satellite. The vulnerability stems from improper validation of values in SQL queries, exploitable by an authenticated, remote attacker. Impact, as stated in sources, is that an attacker c...

CVE-2026-20151

Cisco Smart Software Manager On-Prem (SSM On-Prem) web interface vulnerability allows an authenticated remote user to elevate privileges from low to administrative due to improper transmission of sensitive user information. Exploitation requires valid credentials (role: System User); attacker can...

CVE-2020-3443

CVE-2020-3443 concerns Cisco Smart Software Manager On-Prem (SSM On-Prem). Root cause: insufficient authorization of the System Operator role capabilities, enabling an authenticated remote attacker to log in as System Operator, perform actions, and assume a higher privileged role. Impact: could g...

CVE-2021-34766

The CVE-2021-34766 issue affects Cisco Smart Software Manager On-Prem (SSM On-Prem) Web UI. The root cause is insufficient authorization for System User and System Operator capabilities, allowing an authenticated remote attacker to elevate privileges and perform create/read/update/delete actions ...