VULNERABILITY IN CISCO SMART SOFTWARE MANAGER LETS ATTACKERS CHANGE ANY USER PASSWORD

Summary from the TLDR InfoSec newsletter

Another Cisco critical vulnerability has been disclosed. CVE-2024-20419 allows unauthenticated attackers to change any user's password, including administrators'. This flaw in the password-change process enables access to the web UI or API with compromised user privileges. No workarounds exist. Cisco released a security update and reports no active exploitation.