CVE-2024-20440

Description

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.

References

https://www.securityweek.com/vulnerabilities-expose-cisco-meraki-and-ece-products-to-dos-attacks/

https://www.helpnetsecurity.com/2025/04/03/attackers-are-leveraging-cisco-smart-licensing-utility-static-admin-credentials-cve-2024-20439/

https://www.bleepingcomputer.com/news/security/cisco-warns-of-cslu-backdoor-admin-account-used-in-attacks/

https://securityaffairs.com/176073/hacking/u-s-cisa-adds-cisco-smart-licensing-utility-flaw-known-exploited-vulnerabilities-catalog.html

https://thehackernews.com/2025/03/ongoing-cyber-attacks-exploit-critical.html

https://www.securityweek.com/hackers-target-cisco-smart-licensing-utility-vulnerabilities/

https://www.bleepingcomputer.com/news/security/critical-cisco-smart-licensing-utility-flaws-now-exploited-in-attacks/

https://isc.sans.edu/diary/rss/31782

https://www.bleepingcomputer.com/news/security/cisco-warns-of-backdoor-admin-account-in-smart-licensing-utility/

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3