CVE-2024-20439
Last modified
CVE-2024-20439 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. CISA has confirmed active exploitation in the wild. EPSS estimates a 92.01% chance of exploitation in the next 30 days.
Description
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Smart License Utility | >= 2.0.0, < 2.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-20439?
How severe is CVE-2024-20439?
How do I fix CVE-2024-20439?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-20433A vulnerability in the Resource Reservation Protocol (RSVP) …7.5
- CVE-2024-20434A vulnerability in Cisco IOS XE Software could allow an unau…4.3
- CVE-2024-20435A vulnerability in the CLI of Cisco AsyncOS for Secure Web A…7.8
- CVE-2024-20436A vulnerability in the HTTP Server feature of Cisco IOS XE S…7.5
- CVE-2024-20437A vulnerability in the web-based management interface of Cis…8.8
- CVE-2024-20438A vulnerability in the REST API endpoints of Cisco NDFC coul…5.4
- CVE-2024-2044pgAdmin <= 8.3 is affected by a path-traversal vulnerability…9.9
- CVE-2024-20440A vulnerability in Cisco Smart Licensing Utility could allow…7.5
- CVE-2024-20441A vulnerability in a specific REST API endpoint of Cisco NDF…6.5
- CVE-2024-20442A vulnerability in the REST API endpoints of Cisco Nexus Das…5.4
- CVE-2024-20443A vulnerability in the web-based management interface of Cis…5.4
- CVE-2024-20444A vulnerability in Cisco Nexus Dashboard Fabric Controller (…5.5
Are you affected by CVE-2024-20439?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST