Cisco alert: Flaw impacts Smart Software Manager for on-premises use

TLDR:

• Cisco has released patches for a critical flaw in Smart Software Manager On-Prem that could allow attackers to change user passwords.
• Another critical file write vulnerability in Secure Email Gateway has also been fixed, allowing attackers to add new users with root privileges.

Article Summary:

Cisco has issued patches for a critical vulnerability affecting Smart Software Manager On-Prem (Cisco SSM On-Prem) that could be exploited by remote, unauthenticated attackers to change user passwords, including administrative users. The flaw, tracked as CVE-2024-20419 and with a CVSS score of 10.0, was discovered and reported by security researcher Mohammed Adel. This vulnerability is a result of improper implementation of the password-change process, allowing attackers to access the web UI or API with compromised user privileges.

Additionally, Cisco has addressed another critical file write vulnerability in Secure Email Gateway (CVE-2024-20401) that could enable attackers to add new users with root privileges and cause permanent denial-of-service conditions on affected devices. The flaw affects SEG devices running vulnerable releases of Cisco AsyncOS, although a patch is available via Content Scanner Tools package versions 23.3.0.4823 and later.

Furthermore, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including CVE-2024-34102, a severe flaw that allows remote code execution by mishandling nested deserialization. Other vulnerabilities added to the catalog include Adobe Commerce and Magento Open Source XXE Vulnerability, SolarWinds Serv-U Path Traversal Vulnerability, and VMware vCenter Server Default File Permissions Vulnerability. Federal agencies are required to apply mitigations per vendor instructions by August 7, 2024, to protect their networks against active threats.

This series of vulnerabilities underscores the importance of timely patching and proactive cybersecurity measures to prevent exploitation by malicious actors.