9.1

CVE-2026-76454

Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.

This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt Cisco License On-Prem
Default Statusunknown
Version 7-202001
Status affected
Version 1.1
Status affected
Version 6.3.0
Status affected
Version 8-202004
Status affected
Version 8-202006
Status affected
Version 1.2
Status affected
Version 1.3
Status affected
Version 8-202012
Status affected
Version 8-202010
Status affected
Version 8-202008
Status affected
Version 9-202201
Status affected
Version 8-202102
Status affected
Version 1.4
Status affected
Version 8-202105
Status affected
Version 8-202108
Status affected
Version 8-202112
Status affected
Version 8-202201
Status affected
Version 8-202206
Status affected
Version 8-202212
Status affected
Version 8-202302
Status affected
Version 8-202303
Status affected
Version 8-202304
Status affected
Version 8-202308
Status affected
Version 8-202401
Status affected
Version 8-202404
Status affected
Version 9-202406
Status affected
Version 9-202407
Status affected
Version 9-202410
Status affected
Version 9-202412
Status affected
Version 9-202501
Status affected
Version 9-202502
Status affected
Version 9-202504
Status affected
Version 9-202507
Status affected
Version 9-202510
Status affected
Version 9-202601
Status affected
Version 10-202606
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cisco PSIRT 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE-23 Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE