Cisco SSM On-Prem bug lets hackers change any user's password

Cisco patched CVE-2024-20419, a critical unauthenticated password-change vulnerability in Cisco Smart Software Manager On-Prem (including older SSM Satellite releases) that could allow remote attackers to set any user's password — including administrators — and gain web UI/API access. No workaround exists and affected systems must be upgraded to fixed releases (first fixed: 8-202212; Release 9 not vulnerable); Cisco reports no evidence of active exploitation and additionally references other recent zero-days and state-backed actor activity (UAT4356/STORM-1849) and the ArcaneDoor campaign.