High-Severity Cisco Bug Grants Attackers Password Access
The vulnerability was given the highest CVSS score possible, though few details have been released due to its severity.
![A blue sticky note with "My password 123456" written on it on a laptop keyboard A blue sticky note with "My password 123456" written on it on a laptop keyboard](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt259bf32601c7f480/66997a1e24bd251a92ec5ff9/password(1800)_designer491_alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Cisco has released a patch for a maximum-severity vulnerability, tracked as CVE-2024-20419, that allows threat actors to change any user or admin password.
The vulnerability carries a CVSS rating of 10, however, the company has not released many details about the bug, likely due to how high risk it is.
The attack complexity was deemed low, as no privileges or user interaction is necessary to complete the action, but the impact on the product's integrity, availability, and confidentiality are all deemed high.
"An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device," Cisco said in a statement. "A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user."
This vulnerability affects SSM On-Prem and SSM Satellite. There are no workarounds for the vulnerability, so it's recommended that users apply patches for the bug as soon as possible.
Cisco has not released any additional information regarding this vulnerability in the wild or how many users have been potentially impacted. SSM On-Prem is primarily used by "financial institutions, utilities, service providers, and government organizations," according to the vendor, so organizations in these sectors should be especially wary.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024