CVE-2021-34766— Cisco Smart Software Manager Privilege Escalation Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-34766
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Smart Software Manager Privilege Escalation Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the System User and System Operator role capabilities. An attacker could exploit this vulnerability by directly accessing a web resource. A successful exploit could allow the attacker to create, read, update, or delete records and settings in multiple functions without the necessary permissions on the web UI.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
特权管理不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Smart Software Manager 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Smart Software Manager是美国思科（Cisco）公司的一个为用于提供许可证智能管理功能的软件。该软件消除了繁琐的产品激活密钥（PAK）和许可证文件管理，使许可证节点不再锁定到设备，可以支持再任何兼容的设备上使用许可证。 Cisco Smart Software Manager（SSM On Prem）的web UI中存在安全漏洞，该漏洞源于系统用户和系统操作员角色功能的授权不足。攻击者可利用该漏洞提升权限，并在多个功能中创建、读取、更新或删除记录和设置。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Smart Software Manager On-Prem | n/a | - |
II. Public POCs for CVE-2021-34766
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-34766
请登录查看更多情报信息。
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-priv-esc-5g35cdDJvendor-advisoryx_refsource_CISCO
- https://nvd.nist.gov/vuln/detail/CVE-2021-34766
Same Patch Batch · Cisco · 2021-10-06 · 23 CVEs total
| CVE-2021-34710 | 8.8 HIGH | Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities |
| CVE-2021-34735 | 8.8 HIGH | Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities |
| CVE-2021-34748 | 8.8 HIGH | Cisco Intersight Virtual Appliance Command Injection Vulnerability |
| CVE-2021-34698 | 8.6 HIGH | Cisco Web Security Appliance Proxy Service Denial of Service Vulnerability |
| CVE-2021-1594 | 7.5 HIGH | Cisco Identity Services Engine Privilege Escalation Vulnerability |
| CVE-2021-34788 | 7.0 HIGH | Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) M |
| CVE-2021-34706 | 6.4 MEDIUM | Cisco Identity Services Engine XML External Entity Injection Vulnerability |
| CVE-2021-34742 | 6.1 MEDIUM | Cisco Vision Dynamic Signage Director Reflected Cross-Site Scripting Vulnerability |
| CVE-2021-1534 | 5.8 MEDIUM | Cisco Email Security Appliance URL Filtering Bypass Vulnerability |
| CVE-2021-34711 | 5.5 MEDIUM | Cisco IP Phone Software Arbitrary File Read Vulnerability |
| CVE-2021-34744 | 4.9 MEDIUM | Cisco Business 220 Series Smart Switches Static Key and Password Vulnerabilities |
| CVE-2021-34757 | 4.9 MEDIUM | Cisco Business 220 Series Smart Switches Static Key and Password Vulnerabilities |
| CVE-2021-34772 | 4.7 MEDIUM | Cisco Orbital Open Redirect Vulnerability |
| CVE-2021-34758 | 4.4 MEDIUM | Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerabi |
| CVE-2021-34775 | 4.3 MEDIUM | Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabiliti |
| CVE-2021-34776 | 4.3 MEDIUM | Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabiliti |
| CVE-2021-34777 | 4.3 MEDIUM | Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabiliti |
| CVE-2021-34778 | 4.3 MEDIUM | Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabiliti |
| CVE-2021-34779 | 4.3 MEDIUM | Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabiliti |
| CVE-2021-34780 | 4.3 MEDIUM | Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabiliti |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Cisco Smart Software Manager On-Prem
- CVE-2026-20160
Cisco Smart Software Manager On-Prem Arbitrary Command Execu - CVE-2026-20151
Cisco Smart Software Manager On-Prem Privilege Escalation Vu - CVE-2022-20939
Cisco Smart Software Manager On-Prem Privilege Escalation Vu - CVE-2024-20419
Cisco Smart Software Manager On-Prem 安全漏洞 - CVE-2023-20110
Cisco Smart Software Manager On-Prem SQL Injection Vulnerabi
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-269
- CVE-2026-42562
Plainpad: Privilege Escalation via Writable Admin Field in P - CVE-2026-41163
bubblewrap vulnerable to privilege escalation in setuid mode - CVE-2026-44987
SysReptor: Privilege Escalation from User Admin to Superuser - CVE-2026-42185
People: Privilege Escalation via Missing Role Ceiling in Mai - CVE-2026-40001
Local privilege escalation vulnerability in ZTE PROCESS Guar
V. Comments for CVE-2021-34766
No comments yet