Cisco Smart Software Manager On-Prem 任意命令执行漏洞

CVE-2026-20160 影响 Cisco Smart Software Manager On-Prem (SSM On-Prem)，带来一个关键漏洞，允许未经身份验证的远程攻击者在受影响的 SSM On-Prem 主机的基础操作系统上执行任意命令。此缺陷是由于内部服务意外暴露造成的。攻击者可以通过向暴露服务的 API 发送精心构造的请求来利用此漏洞，从而可能导致执行具有提升权限的命令。CVSS 评分是 9.8，表明风险极高。缺乏修复程序 (fix) 以及 KEV (知识工程验证) 的缺失加剧了情况，需要紧急评估和缓解。

Organizations heavily reliant on Cisco Smart Software Manager On-Prem for managing network devices are particularly at risk. Environments with limited network segmentation or weak access controls are also more vulnerable, as an attacker could more easily reach the exposed API endpoint. Legacy deployments running older, unpatched versions of the software are at the highest risk.

• linux / server: Monitor system logs (journalctl) for unusual API requests targeting the Cisco Smart Software Manager On-Prem service. Look for patterns indicative of crafted requests.

journalctl -u cisco-ssm -f | grep -i "api request"

• generic web: Use curl to probe the exposed API endpoint and observe the response. Unexpected responses or error messages could indicate exploitation attempts.

curl -v <SSM_IP_ADDRESS>/<exposed_api_endpoint>

• cisco: Review Cisco device logs for authentication failures or unusual activity related to the SSM On-Prem service. Check for unauthorized access attempts. • windows / supply-chain: If SSM On-Prem is running on Windows, monitor PowerShell execution logs for suspicious commands related to the SSM service.

Get-WinEvent -LogName Application -FilterXPath '//Event[System[Provider[@Name='PowerShell']]]'

1. 2026-04-01Disclosure

   disclosure

1. 已保留2025-10-08
2. 发布日期2026-04-01
3. 修改日期2026-04-02
4. EPSS 更新日期2026-04-09

由于 Cisco 针对 CVE-2026-20160 没有提供官方修复程序，组织应实施替代缓解措施以降低风险。强烈建议对网络进行隔离，以将 SSM On-Prem 系统与其他关键资源隔离开来。监控到 SSM On-Prem 系统的网络流量，寻找异常模式，可以帮助检测利用尝试。此外，建议审查并强化底层操作系统的安全配置，以限制成功利用的潜在影响。在 SSM On-Prem 系统中的用户帐户上应用最小权限原则也可以帮助减轻损害。请持续监控 Cisco 安全更新，并谨慎地寻找非官方补丁或替代解决方案。