CVEs / CVE-2024-20439
CVE-2024-20439: Cisco Smart Licensing Utility Static Credential Vulnerability
- Known exploited in the CISA KEV catalog since 31 Mar 2025
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 97% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2024-20439
Summary
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
Description
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Smart License Utility | 2.1.0 | — |
| Cisco Cisco Smart License Utility | 2.0.0 | — |
| Cisco Cisco Smart License Utility | 2.2.0 | — |
| cisco cisco_smart_license_utility | 2.1.0 | — |
| cisco cisco_smart_license_utility | 2.0.0 | — |
| cisco cisco_smart_license_utility | 2.2.0 | — |
Exploitation
| In CISA KEV since | 31 Mar 2025 |
|---|---|
| Due date for US federal agencies | 21 Apr 2025 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-912, CWE-798 |
References
- CVE-2024-20439 on NVD
- CVE-2024-20439 in the CISA KEV catalog
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw (cited by CISA)
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20439 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.