CVE-2019-16029: Cisco Smart Software Manager On-Prem Web Interface Denial of Service Vulnerability

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-26 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. The vulnerability is due to the lack of input validation in the API. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to change or corrupt user account information which could grant the attacker administrator access or prevent legitimate user access to the web interface, resulting in a denial of service (DoS) condition.

Affected products

Cisco Smart Software Manager On-Prem: before 7-201910 — fixed in 7-201910

How to fix

Upgrade to a fixed version: Cisco Smart Software Manager On-Prem 7-201910. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-16029 or the next vulnerability affects your stack