CVE-2021-34766: Cisco Smart Software Manager Privilege Escalation Vulnerability
A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the System User and System Operator role capabilities. An attacker could exploit this vulnerability by directly accessing a web resource. A successful exploit could allow the attacker to create, read, update, or delete records and settings in multiple functions without the necessary permissions on the web UI.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Cisco Smart Software Manager On-Prem (SSM On-Prem) vulnerability?
The vulnerability ID for this Cisco Smart Software Manager On-Prem (SSM On-Prem) vulnerability is CVE-2021-34766.
What is the severity level of CVE-2021-34766?
The severity level of CVE-2021-34766 is high.
How does the vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) allow an attacker to elevate privileges?
The vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) allows an authenticated, remote attacker to elevate privileges by exploiting insufficient authorization of the System.
What actions can an attacker perform if they exploit CVE-2021-34766?
If CVE-2021-34766 is exploited, an attacker can create, read, update, or delete records and settings in multiple functions.
Is there a fix available for CVE-2021-34766?
Yes, Cisco has released security updates to address this vulnerability. It is recommended to update to the latest version of Cisco Smart Software Manager On-Prem (SSM On-Prem).