Unauthenticated Password Reset in Cisco License On-Prem

Executive Summary

This vulnerability is in the web-based management interface of Cisco License On-Prem. It allows an unauthenticated remote attacker to gain unauthorized access by exploiting improper checks during the password reset process. An attacker could send a malicious request to reset passwords of any user account, including high-privileged administrative accounts, potentially gaining full access to the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual password reset requests to the Cisco License On-Prem web interface. Check for repeated or automated requests targeting the password reset endpoint. Inspect logs for unauthorized account access or privilege escalation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to reset passwords of any user, including administrators, gaining unauthorized access to the application. This could lead to data breaches, unauthorized modifications, or complete control over the system, depending on the privileges of the compromised accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA. Unauthorized administrative access could result in data breaches, non-compliance with data protection regulations, and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Cisco License On-Prem to a fixed release as soon as possible to address the vulnerability. Cisco has released software updates for this issue.

Useful 0 Not Useful 0