CVE-2026-20151 (GCVE-0-2026-20151)
Vulnerability from cvelistv5
Published
2026-04-01 16:29
Modified
2026-04-02 03:56
Severity ?
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE
  • CWE-201 - Insertion of Sensitive Information Into Sent Data
Summary
A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affected Cisco SSM On-Prem host and retrieving session credentials from subsequent status messages. A successful exploit could allow the attacker to elevate privileges on the affected system from low to administrative. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of System User. Note: This vulnerability exposes information only about users who logged in to the Cisco SSM On-Prem host using the web interface and who are currently logged in. SSH sessions are not affected.
References
Impacted products
Vendor Product Version
Cisco Cisco Smart Software Manager On-Prem Version: 7-202001
Version: 8-202004
Version: 8-202006
Version: 8-202012
Version: 8-202010
Version: 8-202008
Version: 9-202201
Version: 8-202102
Version: 8-202105
Version: 8-202108
Version: 8-202112
Version: 8-202201
Version: 8-202206
Version: 8-202212
Version: 8-202302
Version: 8-202303
Version: 8-202304
Version: 8-202308
Version: 8-202401
Version: 8-202404
Version: 9-202406
Version: 9-202407
Version: 9-202410
Version: 9-202412
Version: 9-202501
Version: 9-202502
Version: 9-202504
Version: 9-202507
Version: 9-202510
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T03:56:09.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Smart Software Manager On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system.\r\n\r\nThis vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affected Cisco SSM On-Prem host and retrieving session credentials from subsequent status messages. A successful exploit could allow the attacker to elevate privileges on the affected system from low to administrative.\r\nTo exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of System User.\r\nNote: This vulnerability exposes information only about users who logged in to the Cisco SSM On-Prem host using the web interface and who are currently logged in. SSH sessions are not affected."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T16:29:13.496Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-cssm-priv-esc-xRAnOuO8",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8"
        }
      ],
      "source": {
        "advisory": "cisco-sa-cssm-priv-esc-xRAnOuO8",
        "defects": [
          "CSCwr86065"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20151",
    "datePublished": "2026-04-01T16:29:13.496Z",
    "dateReserved": "2025-10-08T11:59:15.385Z",
    "dateUpdated": "2026-04-02T03:56:09.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-20151\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-01T18:10:22.544919Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-01T18:10:33.307Z\"}}], \"cna\": {\"title\": \"Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability\", \"source\": {\"defects\": [\"CSCwr86065\"], \"advisory\": \"cisco-sa-cssm-priv-esc-xRAnOuO8\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Smart Software Manager On-Prem\", \"versions\": [{\"status\": \"affected\", \"version\": \"7-202001\"}, {\"status\": \"affected\", \"version\": \"8-202004\"}, {\"status\": \"affected\", \"version\": \"8-202006\"}, {\"status\": \"affected\", \"version\": \"8-202012\"}, {\"status\": \"affected\", \"version\": \"8-202010\"}, {\"status\": \"affected\", \"version\": \"8-202008\"}, {\"status\": \"affected\", \"version\": \"9-202201\"}, {\"status\": \"affected\", \"version\": \"8-202102\"}, {\"status\": \"affected\", \"version\": \"8-202105\"}, {\"status\": \"affected\", \"version\": \"8-202108\"}, {\"status\": \"affected\", \"version\": \"8-202112\"}, {\"status\": \"affected\", \"version\": \"8-202201\"}, {\"status\": \"affected\", \"version\": \"8-202206\"}, {\"status\": \"affected\", \"version\": \"8-202212\"}, {\"status\": \"affected\", \"version\": \"8-202302\"}, {\"status\": \"affected\", \"version\": \"8-202303\"}, {\"status\": \"affected\", \"version\": \"8-202304\"}, {\"status\": \"affected\", \"version\": \"8-202308\"}, {\"status\": \"affected\", \"version\": \"8-202401\"}, {\"status\": \"affected\", \"version\": \"8-202404\"}, {\"status\": \"affected\", \"version\": \"9-202406\"}, {\"status\": \"affected\", \"version\": \"9-202407\"}, {\"status\": \"affected\", \"version\": \"9-202410\"}, {\"status\": \"affected\", \"version\": \"9-202412\"}, {\"status\": \"affected\", \"version\": \"9-202501\"}, {\"status\": \"affected\", \"version\": \"9-202502\"}, {\"status\": \"affected\", \"version\": \"9-202504\"}, {\"status\": \"affected\", \"version\": \"9-202507\"}, {\"status\": \"affected\", \"version\": \"9-202510\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8\", \"name\": \"cisco-sa-cssm-priv-esc-xRAnOuO8\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system.\\r\\n\\r\\nThis vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affected Cisco SSM On-Prem host and retrieving session credentials from subsequent status messages. A successful exploit could allow the attacker to elevate privileges on the affected system from low to administrative.\\r\\nTo exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of System User.\\r\\nNote: This vulnerability exposes information only about users who logged in to the Cisco SSM On-Prem host using the web interface and who are currently logged in. SSH sessions are not affected.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-201\", \"description\": \"Insertion of Sensitive Information Into Sent Data\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2026-04-01T16:29:13.496Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-20151\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-02T03:56:09.678Z\", \"dateReserved\": \"2025-10-08T11:59:15.385Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2026-04-01T16:29:13.496Z\", \"assignerShortName\": \"cisco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.