CVE-2024-20439criticalunder attackCWE-912

CVE-2024-20439: critical vulnerability in Cisco Smart License Utility

Published · Updated

Follow this CVE+ Monitor Cisco Smart License Utility+ Monitor Smart Licensing Utility

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weapon
Published on NVDSep 4
CISA KEV+208d
Action required by CISAfederal deadline: 2025-04-21

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Cisco Smart Licensing Utility has a hidden default admin password that anyone on the internet can use to log in and take full control of the system without needing legitimate credentials.

Technical detail

CVE-2024-20439 exploits an undocumented static administrative credential in CSLU's authentication mechanism (CWE-912: Hidden Functionality). An unauthenticated remote attacker can leverage this hardcoded credential via the application API to gain administrative access without requiring prior authentication or authorization. Successful exploitation grants full administrative control over the CSLU application and its API endpoints.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco Smart License Utility
Related CVEs — Cisco Smart License Utility

In the same product, most dangerous first.

CVE-2024-20440HIGHCVE-2024-20440EPSS 51.9%