Cisco Security Updates – 18 July 2024

The addressed vulnerabilities could allow the attacker to change the password of the users including administrative users, bypass security restrictions, perform spoofing attacks, cause denial of service attacks, elevate privileges to root, redirect the users to a malicious web page, obtain sensitive credential information, execute arbitrary commands/codes, upload arbitrary files, and gain access to the affected system.

Sample of the addressed vulnerabilities:

1. Cisco Smart Software Manager On-Prem Password Change Vulnerability (CVE-2024-20419):

• CVSS: 10
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Privileges

2. Cisco Secure Email Gateway Arbitrary File Write Vulnerability (CVE-2024-20401):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privilege Required: None
• User Interaction: None
• Consequences: Gain Access

Sample of the affected products:

• Cisco Secure Email Gateway.
• Cisco SSM On-Prem.
• Cisco Smart Software Manager Satellite (SSM Satellite).
• Cisco AsyncOS for Secure Web Appliance.