Vulnerability · Published Jun 18, 2020 · Assigned by cisco

CVE-2020-3245Cisco Smart Software Manager On-Prem Improper Access Control Vulnerability

Medium 5.3

In plain English

A medium-severity improper access control in Cisco Smart Software Manager On-Prem from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)1.2%top 31.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to add user accounts to the configuration of an affected device. These accounts would not be administrator or operator accounts.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Smart Software Manager On-Prem	n/a

Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

20200617 Cisco Smart Software Manager On-Prem Improper Access Control Vulnerability vendor-advisory, x_refsource_CISCO