CVE-2021-34766CWE-269

Cisco Smart Software Manager Privilege Escalation Vulnerability

Medium · published October 6, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
61.7
In the wild
Unconfirmed
What it is

A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the System User and System Operator role capabilities. An attacker could exploit this vulnerability by directly accessing a web resource. A successful exploit could allow the attacker to create, read, update, or delete records and settings in multiple functions without the necessary permissions on the web UI.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00974 · 61.7th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2021-10-06T19:45Z
EPSS history
Timeline
  • 06 OCT 19:45Z
    Cisco Smart Software Manager Privilege Escalation Vulnerability
    cvelistv5