Cisco software flaw could have allowed hackers to change any passwords

A white padlock on a dark digital background.
(Image credit: Shutterstock.com)

Cisco has released a patch to fix a maximum-severity vulnerability found on the company’s Smart Software Manager On-Prem instances. 

The networking giant had added there are no workarounds for the flaw, so users should patch immediately, as the vulnerability could allow malicious actors to change the password of any user, administrators included, which could, in some scenarios, result in data theft, and possibly even ransomware attacks.

The vulnerability is tracked as CVE-2024-20419, and has a “perfect” severity score - 10.

Managing Cisco software licenses

“This vulnerability is due to improper implementation of the password-change process,” Cisco said in an advisory bulletin. “An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.”

The Cisco Smart Software Manager On-Prem (SSM On-Prem) is a solution enabling organizations to manage their Cisco software licenses and entitlements within their own network environment (as opposed to the cloud). It offers a centralized, on-premises system for administering Cisco Smart Licensing, which helps customers track and manage their software assets effectively.

In its writeup, ArsTechnica said that it wasn’t entirely clear what hackers could do by abusing the flaw, and speculated that the web user interface and application programming interface could allow them to pivot to other Cisco devices connected to the same network. From there, they could steal data, run ransomware attacks, and similar. 

So far, there is no evidence of the vulnerability being exploited in the wild. 

Cisco is a popular networking gear manufacturer, which also makes it a major target for cyberattacks. In late April this year, unidentified, sophisticated threat actors, possibly affiliated with nation-states in the East, were found abusing two flaws in Cisco VPNs and firewalls, to drop malware used for espionage. Their targets included governments and critical infrastructure networks all around the world.

A month earlier, the company patched a high-severity flaw in one of its software products which could have been leveraged to open a VPN session with a target endpoint.

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Cisco patches critical security issues, so update now
A VPN runs on a mobile phone placed on a laptop keyboard
SonicWall firewalls hit by worrying cyberattack
Webex by Cisco banner on a Chromebook
Cisco warns some Webex users of worrying security flaw, so patch now
Cyber-security
Juniper Session Smart routers have a critical flaw, so patch now
Best free Linux firewalls
SonicWall tells admins to patch worrying SSLVPN flaw immediately
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
Buzz Lightyear Space Ranger Spin Rennovations
Disney’s giving a classic Buzz Lightyear ride a tech overhaul – here's everything you need to know
Hisense U8 series TV on wall in living room
Hisense announces 2025 mini-LED TV lineup, with screen sizes up to 100 inches – and a surprising smart TV switch
Nintendo Music teaser art
Nintendo Music expands its library with songs from Kirby and the Forgotten Land and Tetris
Opera AI Tabs
Opera's new AI feature brings order to your browser tab chaos
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
The iPhone 16 Pro on a grey background
iPhone 17 Pro tipped to get 8K video recording – but I want these 3 video features instead