Cisco Smart Software Manager On-Prem vulnerabilities

A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) allows an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. The issue is due to unintentional exposure of an internal service.

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This is due to improper implementation of the password-change process; an attacker could send crafted HTTP requests to access the web UI or API with the privileges of the compromised user.

A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) allows an authenticated remote attacker to elevate privileges. The issue stems from improper transmission of sensitive user information, enabling session credential retrieval from status messages.