CVE-2024-20439

The CSLU application code contains a static, undocumented administrative account with an immutable password (CWE-912: hidden functionality, CWE-798: hardcoded credentials). An attacker who obtains these credentials can send a login request to the application's API interface without any prior authorization. Because the credentials are identical across all CSLU installations, every network-accessible vulnerable instance is equally exposed. The attack requires no user interaction or special network conditions.

An attacker gains full administrative access to the Cisco Smart Licensing Utility API interface, enabling reading and modification of licensing configuration and potentially serving as an entry point for further lateral movement within the organization's network.

Apply patches available from the vendor according to the references — detailed information about patched versions is contained in the Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw. Until the patch is deployed, it is recommended to restrict network access to the CSLU API interface exclusively to trusted hosts (firewall, ACL).

Cisco Smart Licensing Utility (CSLU) — versions indicated in the vendor's references (Cisco advisory cisco-sa-cslu-7gHMzWmw)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.