Cisco has warned admins to patch a critical Cisco Smart Licensing Utility (CSLU) vulnerability, which exposes a built-in backdoor admin account now used in attacks. CSLU is a Windows app for managing licenses and linked products on-premises without connecting them to Cisco's cloud-based Smart Software Manager solution. Cisco patched this security flaw (CVE-2024-20439) in September, describing it as "an undocumented static user credential for an administrative account" that lets unauthenticated attackers log into unpatched systems remotely with admin privileges over the Cisco Smart Licensing Utility (CSLU) app's API. CVE-2024-20439 only impacts systems running vulnerable Cisco Smart Licensing Utility releases, but it's only exploitable if the user starts the CSLU app (which doesn't run in the background by default). Aruba threat researcher Nicholas Starke reverse-engineered the vulnerability two weeks after Cisco released security patches and published a write-up with technical details (including the decoded hardcoded static password). "In March 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability in the wild," the company said in a Tuesday update to the original security advisory. "Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability." While Cisco didn't share any details on these attacks, Johannes Ullrich, SANS Technology Institute's De...
Cisco warns of CSLU backdoor admin account used in attacks
BleepingComputer
·Sergiu Gatlan
·Published Apr 2, 2025
·Updated
Affected Software
2 affected components
Cisco Smart Licensing Utility
Cisco Smart Licensing Utility
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a critical vulnerability in Cisco's Smart Licensing Utility that involves a backdoor admin account being exploited in attacks.
2
What security implications are discussed?
The article highlights the serious risk posed by the CSLU backdoor, which can allow unauthorized access and control over systems using the Cisco Smart Licensing Utility.
3
What products or software are affected?
The affected product in this article is the Cisco Smart Licensing Utility.
4
What action are administrators advised to take?
Administrators are urged to patch the vulnerability in the Cisco Smart Licensing Utility to prevent exploitation.
5
Who published the warning about the vulnerability?
The warning about the vulnerability was published by Cisco.