Security News > 2024 > July > Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager

Cisco has released patches to address a maximum-severity security flaw impacting Smart Software Manager On-Prem that could enable a remote, unauthenticated attacker to change the password of any users, including those belonging to administrative users.

"An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user."

It's worth noting that version 9 is not susceptible to the flaw.

The disclosure comes as the U.S. Cybersecurity and Infrastructure Security Agency added three vulnerabilities to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation -.

CVE-2024-34102, which is also referred to as CosmicSting, is a severe security flaw arising from improper handling of nested deserialization, allowing attackers to achieve remote code execution.

A proof-of-concept exploit for the flaw was released by Assetnote late last month.

News URL

https://thehackernews.com/2024/07/cisco-warns-of-critical-flaw-affecting.html