Read the docs
TI-2019-12064 Aliases CVE-2019-16029GHSA-v2h7-ph6x-hrqm

Cisco Smart Software Manager On-Prem Web Interface Denial of Service Vulnerability

Priority MEDIUM 47CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. The vulnerability is due to the lack of input validation in the API. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to change or corrupt user account information which could grant the attacker administrator access or prevent legitimate user access to the web interface, resulting in a denial of service (DoS) condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01073 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Smart Software Manager On-Premall versions—No fix listedCNA
  • Cisco Smart Software Manager On-Prem VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:smart_software_manager_on-prem:*:*:*:*:*:*:*:*before 7-201910VulnerableCisco
  • cpe:2.3:a:cisco:smart_software_manager_on-prem:*:*:*:*:*:*:*:* Versions before 7-201910 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16029
  2. 2026-10-03 Alias added: GHSA-v2h7-ph6x-hrqm

References

Advisory 1

  • TI-2024-13352 A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM… CVSS 3.1CRITICAL 10.0
  • TI-2020-02720 Cisco Smart Software Manager On-Prem Static Default Credential Vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2026-16368 Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2020-02991 Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-13764 Cisco Smart Software Manager Privilege Escalation Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-00949 Cisco Smart Software Manager Satellite SQL Injection Vulnerability CVSS 3.1HIGH 8.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences