PT-2021-1898 · Cisco · Cisco Smart Software Manager Satellite+1

Published 2021-01-20 · Updated 2021-01-28 · CVE-2021-1219

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Smart Software Manager On-Prem (affected versions not specified) Cisco Smart Software Manager Satellite (affected versions not specified)

Description The issue is related to insufficient input validation and protection of static credentials in the affected software. An authenticated, local attacker could exploit this to access sensitive information on the affected system, including viewing static credentials stored on the local device. These credentials could then be used to carry out further attacks.

Recommendations For Cisco Smart Software Manager On-Prem, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Smart Software Manager Satellite, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2021-00669

CVE-2021-1219

Affected Products

Cisco Smart Software Manager On-Prem

Cisco Smart Software Manager Satellite

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-sc-Jd42D4Tq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1219 · Security Note
• https://bdu.fstec.ru/vul/2021-00669 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1219 · Vendor Advisory
• https://t.me/cvenotify/8800 · Telegram Post
• https://t.me/cibsecurity/22458 · Telegram Post