CVE-2024-20439—Cisco Smart Licensing Utility Static Credential Vulnerability

Vulnerability Name

Cisco Smart Licensing Utility Static Credential Vulnerability

Description

Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw
• https://nvd.nist.gov/vuln/detail/CVE-2024-20439

Related News Articles

• Cisco Webex bug lets hackers gain code execution via meeting linksApril 18, 2025
• Attackers are leveraging Cisco Smart Licensing Utility static admin credentials (CVE-2024-20439)April 3, 2025
• Cisco warns of CSLU backdoor admin account used in attacksApril 2, 2025

Related Weaknesses

• CWE-912