Cisco License On-Prem vulnerabilities

Vulnerability in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) related to insufficient protection against code injection (CWE-94). Discovered during an internal security review, addressed in software hardening releases.

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. The vulnerability is due to insufficient validation of user-supplied input. Exploitation requires valid administrative user credentials.

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The vulnerability is due to improper validation of user-supplied content within configurations submitted to the web-based management interface. Exploitation requires valid administrative credentials.

A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to insufficiently protected credentials (CWE-522). These have been addressed in hardening releases.

A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to improper input verification (CWE-347). These have been addressed in hardening releases.

Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) contains vulnerabilities related to improper authentication, grouped under CWE-306. They were discovered during an internal security review and addressed in a hardening release.

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem (formerly SSM On-Prem) could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition. It is due to improper input validation and lack of authentication in the management API.

A vulnerability in the web-based management interface of Cisco License On-Prem (formerly SSM On-Prem) could allow an unauthenticated, remote attacker to gain unauthorized access to the application. It is due to improper checks during the password reset process.