4.9

CVE-2026-76452

Cisco Smart Software Manager On-Prem SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality.
To exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt Cisco License On-Prem
Default Statusunknown
Version 7-202001
Status affected
Version 1.1
Status affected
Version 6.3.0
Status affected
Version 8-202004
Status affected
Version 8-202006
Status affected
Version 1.2
Status affected
Version 1.3
Status affected
Version 8-202012
Status affected
Version 8-202010
Status affected
Version 8-202008
Status affected
Version 9-202201
Status affected
Version 8-202102
Status affected
Version 1.4
Status affected
Version 8-202105
Status affected
Version 8-202108
Status affected
Version 8-202112
Status affected
Version 8-202201
Status affected
Version 8-202206
Status affected
Version 8-202212
Status affected
Version 8-202302
Status affected
Version 8-202303
Status affected
Version 8-202304
Status affected
Version 8-202308
Status affected
Version 8-202401
Status affected
Version 8-202404
Status affected
Version 9-202406
Status affected
Version 9-202407
Status affected
Version 9-202410
Status affected
Version 9-202412
Status affected
Version 9-202501
Status affected
Version 9-202502
Status affected
Version 9-202504
Status affected
Version 9-202507
Status affected
Version 9-202510
Status affected
Version 9-202601
Status affected
Version 10-202606
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cisco PSIRT 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE