by Kastro
Paper/Archive/CVE-2024-20439

CVE-2024-20439

Cisco Cisco Smart License Utility — Cisco Smart Licensing Utility Static Credential Vulnerability

KEV · due 21 AprEPSS 97%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.

Affected

ProductAffectedFixed inSource
Cisco Smart License Utility2.1.0–CNA
Cisco Smart License Utility2.0.0–CNA
Cisco Smart License Utility2.2.0–CNA
cisco_smart_license_utility2.1.0–CISA-ADP
cisco_smart_license_utility2.0.0–CISA-ADP
cisco_smart_license_utility2.2.0–CISA-ADP
cisco_smart_license_utility2.1.0–CISA-ADP
cisco_smart_license_utility2.0.0–CISA-ADP
cisco_smart_license_utility2.2.0–CISA-ADP
cisco_smart_license_utility2.1.0–CISA-ADP
cisco_smart_license_utility2.0.0–CISA-ADP
cisco_smart_license_utility2.2.0–CISA-ADP

Scores by source

cisco (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmwrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20439kevcisa.gov/known-exploited-vulnerabilities-catalog