CVE-2024-20419: Cisco Smart Software Manager On-Prem password change authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network reachability, no authentication, and scope change, combined with a very high EPSS probability, makes this an urgent pre-auth takeover risk.

What it is

Cisco Smart Software Manager On-Prem (SSM On-Prem) implements the password-change process improperly, allowing an unauthenticated remote attacker to change the password of any user, including administrators. Because the flaw sits in the authentication system and requires no credentials, it exposes the management plane of the product to full takeover.

Impact

An attacker can reset arbitrary account passwords and then log into the web UI or API with the privileges of the compromised user, including administrative privileges. This yields full control of the affected SSM On-Prem instance.

Attack surface

Reachable over the network via crafted HTTP requests to the affected device's web interface or API; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.80635, 99.6th percentile), indicating strong likelihood of attempted exploitation. References are vendor and third-party advisories only, with no public exploit tag.

What to do

• Apply the Cisco security advisory fix for SSM On-Prem as the first action.
• Restrict network access to the SSM On-Prem web UI and API to trusted management networks or VPN.
• Audit and rotate credentials for all SSM On-Prem accounts, especially administrative users, and review for unauthorized password changes.
• Monitor Cisco advisory updates for any revised fixed versions or workarounds.
• Where patching is delayed, consider taking the management interface offline or placing it behind strict access controls.

Detection

• Review SSM On-Prem authentication and password-change logs for unexpected or out-of-band password resets, particularly for admin accounts.
• Alert on password-change HTTP requests originating from untrusted or unexpected source IPs.
• Correlate successful logins immediately following a password change from a new source.
• Monitor for anomalous API or web UI sessions using accounts whose passwords were recently changed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.