CVE-2024-20439

State: Published
Severity: 9.8 Critical
Published: Sep 4, 2024
Updated: Oct 21, 2025
Reserved: Nov 8, 2023

Description

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-912 Hidden Functionality

Affected Products

Product	Versions
Cisco Smart License UtilityCisco	2.1.0Affected 2.0.0Affected 2.2.0Affected

References

cisco-sa-cslu-7gHMzWmw
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20439government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.