A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device.
This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
Security Impact Rating: Medium
Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information.
Receiver 4.4 installed on a non domain computer. SSON is available in CSGW and works with domain computers. When starting the application the first time you are prompted for username and password. If you click Cancel and start the application again you automatically logged in. I have tried to install with sson, added registry values to save password and sites but still the problem remains.