Cisco License (Smart Software Manager) On-Prem Multiple Vulnerabilities (cisco-sa-ssm-access-nttb2dhE)

critical Nessus Plugin ID 364455

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

According to its self-reported version, Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) is affected by multiple vulnerabilities, including:

- A vulnerability in the web-based management interface of Cisco License On-Prem could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts. (CVE-2026-20328)

- A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. (CVE-2026-76454)

- A vulnerability in the web-based user interface of Cisco License On-Prem could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands on the underlying operating system with root privileges. This vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. (CVE-2026-76437)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to Cisco License On-Prem 10-202608 or later. Releases 9-202601 and earlier (Cisco Smart Software Manager On-Prem) must migrate to a fixed Cisco License On-Prem release.

Plugin Details

Severity: Critical

ID: 364455

File Name: cisco-sa-ssm-access-nttb2dhE.nasl

Version: 1.1

Type: Combined

Family: CISCO

Published: 10/9/2026

Updated: 10/9/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.31

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-20328

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:smart_software_manager_on-prem

Required KB Items: installed_sw/Cisco Smart Software Manager On-Prem

Exploit Ease: No known exploits are available

Patch Publication Date: 10/7/2026

Vulnerability Publication Date: 10/7/2026

Reference Information

CVE: CVE-2026-20328, CVE-2026-76437, CVE-2026-76452, CVE-2026-76454

CWE: 23, 78, 862, 89

CISCO-SA: cisco-sa-ssm-access-nttb2dhE

IAVA: 2026-A-1090

CISCO-BUG-ID: CSCwu54774, CSCwv53803, CSCwv53807, CSCwv53814

Detections

Analytics