Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability

A vulnerability exists in Cisco Smart Software Manager On-Prem (SSM On-Prem) that allows an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected host. This issue arises from the unintended exposure of an internal service, which can be exploited by sending a crafted request to the API of the exposed service. Successful exploitation grants root-level privileges on the operating system.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected host's operating system with root-level privileges.

Remediation

Cisco has released software updates to address this vulnerability. For versions earlier than 9-202502, users should upgrade to a version that is not vulnerable. For versions 9-202502 to 9-202510, users should upgrade to 9-202601.