Cisco License On Prem
Monthly
Remote code execution in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets a network-positioned attacker who holds only low-privilege credentials inject and execute code on the appliance, resulting in complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is one of multiple internally discovered code-injection weaknesses (CWE-94) that Cisco addressed in a bundled hardening release for the product, so the specific vulnerable endpoint is not individually itemized in the advisory. There is confirmed actively exploited status neither reported nor any public exploit identified at time of analysis, but the low-complexity, no-user-interaction profile and requirement for only an ordinary authenticated account make rapid patching of internet- or partner-reachable instances important; exploitation status is best described as no public exploit identified at time of analysis.
Remote, unauthenticated attackers can reach insufficiently protected credentials in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) and potentially read and modify them, based on Cisco's hardening advisory covering several internally discovered CWE-522 issues tracked under this single CVE. Cisco rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The wildcard CPE cpe:2.3:a:cisco:cisco_license_on-prem:*:*:*:*:*:*:*:* indicates all shipping versions are affected until the vendor's hardening release is applied; no public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing and no PoC referenced), and practical exposure is constrained because these on-prem appliances normally sit on internal management networks rather than the public internet.
Unauthenticated remote attackers can bypass the cryptographic signature verification on authentication tokens in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem), so a forged JSON Web Token is accepted as authentic and the licensing server can be fully compromised; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0, meaning no credentials and no user interaction are required, low complexity, a scope change, and high impact to confidentiality, integrity and availability. Cisco's internal hardening review addressed this together with other internally discovered issues, and the advisory-linked hardening releases are the fix path, with no exact patched version numbers disclosed in the available data; the practical limiting factor is network exposure of the management/licensing interface, since the attacker must be able to reach the instance. No CISA KEV entry exists and no public exploit code has been identified at time of analysis, so this is a maximum-severity but not yet observed-exploited issue.
Missing authentication for critical functions in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem) lets unauthenticated remote attackers reach protected functionality with no credentials and no user interaction, exposing confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The issues were discovered during Cisco's own internal security review and are bundled into a hardening release documented in Cisco advisory cisco-sa-hardening-ssm-Ph77wdhf rather than being tied to a single feature or endpoint. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but because the licensing server is frequently deployed on internal networks with broad reach to managed devices and license data, any internet- or flat-network-exposed instance should be treated as an urgent patch priority.
Unauthenticated remote attackers can write arbitrary files or cause a denial-of-service condition on Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) via the Cisco Smart Licensing Utility management API. The vulnerability arises from improper input validation and missing authentication, allowing crafted requests to traverse paths and modify system files or disrupt service. No public exploit code exists and exploitation has not been confirmed as active (CISA KEV); exploitation requires only network reachability to the management API.
Unauthenticated remote attackers can reset the password of any account, including administrative users, in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) by exploiting improper authorization checks in the web-based password-reset function, leading to full application compromise. The flaw has a CVSS score of 9.1 (AV:N/AC:L/PR:N/UI:N) and requires only network reachability to the management interface; no public exploit has been identified at time of analysis. Deployments exposing the interface to untrusted networks are at highest risk, while well-segmented instances are materially harder to attack.
OS command injection in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) allows an authenticated remote attacker holding system administrator credentials to submit a crafted configuration update that is executed as root on the underlying operating system. Scored CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), the flaw is heavily constrained by its PR:H authentication prerequisite: because the attacker must already be a full administrator, the marginal capability gained is limited to shutting down or disrupting the host (availability impact only), which the assessed vector reflects with C:N/I:N/A:H. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied in the source data.
Authenticated SQL injection in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets an attacker who already holds valid administrative credentials send a crafted request that reads internal database contents normally hidden from administrative users, impacting confidentiality only. The flaw is rated CVSS 3.1 4.9 (Medium) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, confirming it is remotely reachable but gated behind high privileges, with no integrity or availability impact and no user interaction required. There is no KEV listing and no public exploit identified at time of analysis, so the realistic risk is concentrated among insiders or anyone who has obtained administrator credentials for the license management portal rather than anonymous internet attackers.
Remote code execution in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets a network-positioned attacker who holds only low-privilege credentials inject and execute code on the appliance, resulting in complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is one of multiple internally discovered code-injection weaknesses (CWE-94) that Cisco addressed in a bundled hardening release for the product, so the specific vulnerable endpoint is not individually itemized in the advisory. There is confirmed actively exploited status neither reported nor any public exploit identified at time of analysis, but the low-complexity, no-user-interaction profile and requirement for only an ordinary authenticated account make rapid patching of internet- or partner-reachable instances important; exploitation status is best described as no public exploit identified at time of analysis.
Remote, unauthenticated attackers can reach insufficiently protected credentials in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) and potentially read and modify them, based on Cisco's hardening advisory covering several internally discovered CWE-522 issues tracked under this single CVE. Cisco rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The wildcard CPE cpe:2.3:a:cisco:cisco_license_on-prem:*:*:*:*:*:*:*:* indicates all shipping versions are affected until the vendor's hardening release is applied; no public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing and no PoC referenced), and practical exposure is constrained because these on-prem appliances normally sit on internal management networks rather than the public internet.
Unauthenticated remote attackers can bypass the cryptographic signature verification on authentication tokens in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem), so a forged JSON Web Token is accepted as authentic and the licensing server can be fully compromised; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0, meaning no credentials and no user interaction are required, low complexity, a scope change, and high impact to confidentiality, integrity and availability. Cisco's internal hardening review addressed this together with other internally discovered issues, and the advisory-linked hardening releases are the fix path, with no exact patched version numbers disclosed in the available data; the practical limiting factor is network exposure of the management/licensing interface, since the attacker must be able to reach the instance. No CISA KEV entry exists and no public exploit code has been identified at time of analysis, so this is a maximum-severity but not yet observed-exploited issue.
Missing authentication for critical functions in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem) lets unauthenticated remote attackers reach protected functionality with no credentials and no user interaction, exposing confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The issues were discovered during Cisco's own internal security review and are bundled into a hardening release documented in Cisco advisory cisco-sa-hardening-ssm-Ph77wdhf rather than being tied to a single feature or endpoint. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but because the licensing server is frequently deployed on internal networks with broad reach to managed devices and license data, any internet- or flat-network-exposed instance should be treated as an urgent patch priority.
Unauthenticated remote attackers can write arbitrary files or cause a denial-of-service condition on Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) via the Cisco Smart Licensing Utility management API. The vulnerability arises from improper input validation and missing authentication, allowing crafted requests to traverse paths and modify system files or disrupt service. No public exploit code exists and exploitation has not been confirmed as active (CISA KEV); exploitation requires only network reachability to the management API.
Unauthenticated remote attackers can reset the password of any account, including administrative users, in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) by exploiting improper authorization checks in the web-based password-reset function, leading to full application compromise. The flaw has a CVSS score of 9.1 (AV:N/AC:L/PR:N/UI:N) and requires only network reachability to the management interface; no public exploit has been identified at time of analysis. Deployments exposing the interface to untrusted networks are at highest risk, while well-segmented instances are materially harder to attack.
OS command injection in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) allows an authenticated remote attacker holding system administrator credentials to submit a crafted configuration update that is executed as root on the underlying operating system. Scored CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), the flaw is heavily constrained by its PR:H authentication prerequisite: because the attacker must already be a full administrator, the marginal capability gained is limited to shutting down or disrupting the host (availability impact only), which the assessed vector reflects with C:N/I:N/A:H. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied in the source data.
Authenticated SQL injection in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets an attacker who already holds valid administrative credentials send a crafted request that reads internal database contents normally hidden from administrative users, impacting confidentiality only. The flaw is rated CVSS 3.1 4.9 (Medium) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, confirming it is remotely reachable but gated behind high privileges, with no integrity or availability impact and no user interaction required. There is no KEV listing and no public exploit identified at time of analysis, so the realistic risk is concentrated among insiders or anyone who has obtained administrator credentials for the license management portal rather than anonymous internet attackers.