Critical severity · published Sep 4, 2024
CVE-2024-20439
Cisco Smart Licensing Utility Static Credential Vulnerability
In wildKEV
9.8
CVSS
97.1%
EPSS
Yes
On KEV
Description
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.
This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)97.1% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 31, 2025
Federal remediation dueApr 21, 2025
Ransomware campaign useNot known
Affected products
Which versions
CS
Cisco Smart License Utility · Cisco
2.1.0; 2.0.0; 2.2.0 · source: vendor, CISA
SL
Smart License Utility · Cisco
2.0.0 before 2.3.0 · source: NVD
SL
Smart Licensing Utility · Cisco
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20439
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20439
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
sec.cloudapps.cisco.com
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw
More from Cisco Smart License Utility
7.5
CVE-2024-20440
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information