CVE-2024-20439: Cisco Smart Licensing Utility Static Credential Vulnerability
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
Other sources
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
— CISA
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-20439?
The severity of CVE-2024-20439 is classified as high due to the potential for unauthorized access to systems.
How do I fix CVE-2024-20439?
To fix CVE-2024-20439, update Cisco Smart Licensing Utility to the latest version that addresses the static credential issue.
What systems are affected by CVE-2024-20439?
CVE-2024-20439 affects Cisco Smart Licensing Utility versions between 2.0.0 and 2.3.0.
Can CVE-2024-20439 be exploited remotely?
Yes, CVE-2024-20439 can be exploited remotely by an unauthenticated attacker.
What is the cause of CVE-2024-20439?
CVE-2024-20439 is caused by the presence of an undocumented static user credential for an administrative account.