Description:

CVE-2024-20419 is a critical vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) that allows an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process.

Key Insights:

• High Severity: The CVSS score of 10 indicates that this vulnerability is highly severe and requires immediate attention.
• SVRS Score: The SOCRadar Vulnerability Risk Score (SVRS) of 36 highlights the urgency of this threat, as a score above 80 signifies a critical vulnerability.
• Active Exploitation: This vulnerability is actively exploited in the wild, making it a significant threat to organizations using Cisco SSM On-Prem.

Mitigation Strategies:

• Apply Software Updates: Install the latest software updates from Cisco to patch the vulnerability.
• Enable Two-Factor Authentication: Implement two-factor authentication for all user accounts to prevent unauthorized access.
• Monitor Network Traffic: Monitor network traffic for suspicious activity and block any attempts to exploit the vulnerability.
• Restrict Access: Limit access to the web UI and API to only authorized users.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.