SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20328

CRITICAL(9.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Risk Signal Score23/100 — NIEDRIG
  • CVSS 9.1 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.1

Technische Schwere

Beschreibung

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "password reset" and InitiatingProcessCommandLine contains "malicious request"

Splunk SPL

index=* (password reset) (malicious request)

Sigma

title: Cisco License On-Prem Password Reset Vulnerability
status: experimental
description: Detects attempts to exploit CVE-2026-20328 in Cisco License On-Prem by monitoring for suspicious password reset requests.
logsource:
  category: webserver
  product: cisco_license_on_prem
detection:
  selection:
    http.request.uri: '*passwordreset*'
    http.request.method: 'POST'
    http.request.body: '*malicious*'
  condition: selection
level: critical

Elastic ES|QL

from logs-webserver-cisco_license_on_prem*
| where http.request.uri : '*passwordreset*' and http.request.method == 'POST' and http.request.body : '*malicious*'

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen