CVE-2024-20419
Cisco Smart Software Manager On-Prem ≤ 8-202112
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2024-20419 is a critical-severity Unverified Password Change (CWE-620) vulnerability in Cisco Smart Software Manager On-Prem. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-11 (Re-authentication) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) stems from improper implementation of the password-change process. This flaw enables an unauthenticated remote attacker to alter the password of any user account, including administrative ones, by sending crafted HTTP requests to an affected device. The issue carries a CVSS score of 10.0 and is tracked under CWE-620.
An attacker who successfully exploits the vulnerability can obtain access to the web UI or API using the privileges of the compromised account. The EPSS score stands at a current and peak value of 0.9147. The primary advisory reference is the Cisco security bulletin at sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18134
Vulnerability Data
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change…
more
process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Re-authentication explicitly requires users to prove identity before performing sensitive actions such as password changes.
Authenticator management requires identity verification during password distribution and changes, directly stopping unverified password updates.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure management of authentication information, directly addressing the need to verify the original password before allowing a change.
Mandates secure authentication mechanisms, which include verifying existing credentials before permitting password changes.
Identity management processes can incorporate verification steps, but the control itself does not explicitly require password-change verification.
Information access restriction can be strengthened by password verification, yet the control focuses on access rights rather than change procedures.