Cisco Smart vulnerabilities

CVE-2023-20110 Cisco Smart Software Manager On-Prem SQL Injection Vulnerability CVE-2023-20110: Cisco Smart Software Manager On-Prem SQL Injection Vulnerability A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit

CVE-2021-1138 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities CVE-2021-1138: Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the CVSS: 3.1 CWE: CWE-20, CWE-20 Bug IDs: CSCvm42428, CSCvm42

CVE-2021-1218 Cisco Smart Software Manager Satellite Open Redirect Vulnerability CVE-2021-1218: Cisco Smart Software Manager Satellite Open Redirect Vulnerability A vulnerability in the web management interface of Cisco Smart Software Manager satellite could allow an authenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit

CVE-2022-20939 Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability CVE-2022-20939: Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to inadequate protection of sensitive user information. An attacker could exploit this vulnerability by accessing

CVE-2021-1139 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities CVE-2021-1139: Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the CVSS: 3.1 CWE: CWE-20, CWE-20 Bug IDs: CSCvm42428, CSCvm42

CVE-2026-20151 Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability CVE-2026-20151: Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a

CVE-2020-3158 Cisco Smart Software Manager On-Prem Static Default Credential Vulnerability CVE-2020-3158: Cisco Smart Software Manager On-Prem Static Default Credential Vulnerability A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account that has a default and static password and is not under t

CVE-2021-1222 Cisco Smart Software Manager Satellite SQL Injection Vulnerability CVE-2021-1222: Cisco Smart Software Manager Satellite SQL Injection Vulnerability A vulnerability in the web-based management interface of Cisco Smart Software Manager Satellite could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates values within SQL queries. An attacker could explo

CVE-2026-20160 Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host. This vulnerability is due to the unintentional exposure of an internal service. An attacker cou

CVE-2020-3245 Cisco Smart Software Manager On-Prem Improper Access Control Vulnerability CVE-2020-3245: Cisco Smart Software Manager On-Prem Improper Access Control Vulnerability A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this vulnerability by sending a

CVE-2021-1140 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities CVE-2021-1140: Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the CVSS: 3.1 CWE: CWE-20, CWE-20 Bug IDs: CSCvm42428, CSCvm42

CVE-2024-20419 Cisco Smart Software Manager On-Prem Password Change Vulnerability CVE-2024-20419: Cisco Smart Software Manager On-Prem Password Change Vulnerability A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vuln

CVE-2021-1141 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities CVE-2021-1141: Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the CVSS: 3.1 CWE: CWE-20, CWE-20 Bug IDs: CSCvm42428, CSCvm42

CVE-2021-34766 Cisco Smart Software Manager Privilege Escalation Vulnerability CVE-2021-34766: Cisco Smart Software Manager Privilege Escalation Vulnerability A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the System User and System Operator role capabilit

CVE-2019-16029 Cisco Smart Software Manager On-Prem Web Interface Denial of Service Vulnerability CVE-2019-16029: Cisco Smart Software Manager On-Prem Web Interface Denial of Service Vulnerability A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. The v

CVE-2021-1219 Cisco Smart Software Manager Satellite Static Credential Vulnerability CVE-2021-1219: Cisco Smart Software Manager Satellite Static Credential Vulnerability A vulnerability in Cisco Smart Software Manager Satellite could allow an authenticated, local attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by gaining access to the s

CVE-2021-1142 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities CVE-2021-1142: Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the CVSS: 3.1 CWE: CWE-20, CWE-20 Bug IDs: CSCvm42428, CSCvm42

CVE-2020-3443 Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability CVE-2020-3443: Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and execute commands with higher privileges. The vulnerability is due to insufficient authorization of the System Operator role capabilities. An attacker could exploit this vulnerability by

CVE-2022-20808 Cisco Smart Software Manager On-Prem Denial of Service Vulnerability CVE-2022-20808: Cisco Smart Software Manager On-Prem Denial of Service Vulnerability A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect handling of multiple simultaneous device registrations on Cisco SSM On-Prem. An attacker could exploit this