Cisco Smart Software Manager On-Prem vulnerabilities

CVE-2026-20160 [CRITICAL] CWE-668 CVE-2026-20160: A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host. This vulnerability is due to the unintentional exposure of an internal service. An attacker could exploit this vulnerability by send

CVE-2026-20151 [HIGH] CWE-201 CVE-2026-20151: A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could all A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affe

CVE-2022-20939 [MEDIUM] CWE-922 CVE-2022-20939: A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem c A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to inadequate protection of sensitive user information. An attacker could exploit this vulnerability by accessing certain logs on an affecte

CVE-2024-20419 [CRITICAL] CWE-620 CVE-2024-20419: A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) c A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by s

CVE-2023-20110 [MEDIUM] CWE-89 CVE-2023-20110: A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM O A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnera

CVE-2022-20808 [HIGH] CWE-400 CVE-2022-20808: A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect handling of multiple simultaneous device registrations on Cisco SSM On-Prem. An attacker could exploit this vulnerability by sendin

CVE-2021-34766 [MEDIUM] CWE-269 CVE-2021-34766: A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an a A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the System User and System Operator role capabilities. An at

CVE-2021-1138 [CRITICAL] CWE-20 CVE-2021-1138: Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unau Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.

CVE-2021-1142 [CRITICAL] CWE-20 CVE-2021-1142: Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unau Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.

CVE-2021-1140 [CRITICAL] CWE-20 CVE-2021-1140: Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unau Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.

CVE-2021-1219 [HIGH] CWE-798 CVE-2021-1219: A vulnerability in Cisco Smart Software Manager Satellite could allow an authenticated, local attack A vulnerability in Cisco Smart Software Manager Satellite could allow an authenticated, local attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by gaining access to the static credential that is s

CVE-2021-1141 [CRITICAL] CWE-20 CVE-2021-1141: Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unau Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.

CVE-2021-1139 [CRITICAL] CWE-20 CVE-2021-1139: Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unau Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.

CVE-2021-1222 [HIGH] CWE-89 CVE-2021-1222: A vulnerability in the web-based management interface of Cisco Smart Software Manager Satellite coul A vulnerability in the web-based management interface of Cisco Smart Software Manager Satellite could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates values within SQL queries. An attacker could exploit this vulnerabili

CVE-2021-1218 [MEDIUM] CWE-601 CVE-2021-1218: A vulnerability in the web management interface of Cisco Smart Software Manager satellite could allo A vulnerability in the web management interface of Cisco Smart Software Manager satellite could allow an authenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit this vulnerabil

CVE-2020-3443 [HIGH] CWE-264 CVE-2020-3443: A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and execute commands with higher privileges. The vulnerability is due to insufficient authorization of the System Operator role capabilities. An attacker could exploit this vulnerability by logging in with the System O

CVE-2020-3245 [MEDIUM] CWE-284 CVE-2020-3245: A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could a A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affec

CVE-2020-3158 [CRITICAL] CWE-798 CVE-2020-3158: A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account that has a default and static password and is not under the control of the system administra

CVE-2019-16029 [CRITICAL] CWE-20 CVE-2019-16029: A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Pr A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. The vulnerability is due to the lack of input valida