{"id":"CVE-2024-20439","published":"2024-09-04T17:15:13Z","modified":"2026-06-17T07:07:06Z","title":"Cisco Smart Licensing Utility Static Credential Vulnerability","vendor":"Cisco","product":"Smart Licensing Utility","tier":"core","eol":null,"description":{"text":"A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.\r\n\r This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.","provenance":"source","from":"NVD"},"summary":{"text":"Cisco Smart Licensing Utility (CSLU) contains a flaw in which an undocumented static administrative credential is built into the product. An unauthenticated attacker with network access to the affected system can use that hard-coded credential to log in and gain administrative rights over the CSLU application API, with no user interaction or prior authentication required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:45Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9709,"percentile":0.99892,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-03-31","dueDate":"2025-04-21","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw ; https://nvd.nist.gov/vuln/detail/CVE-2024-20439","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-02-27","exploitedFirstSeen":"2025-02-27","ransomware":false,"evidence":[{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","date":"2025-02-27"},{"url":"https://isc.sans.edu/diary/Exploit+Attempts+for+Cisco+Smart+Licensing+Utility+CVE202420439+and+CVE202420440/31782","date":"2025-03-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-03-31"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw","date":"2025-04-01"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-20439","date":"2025-06-07"},{"url":"https://arcticwolf.com/resources/blog/cve-2025-20309/","date":"2025-07-03"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-Early-Warning-Signals-Attacker-Behavior-Precedes-New-Vulnerabilities-Report.pdf","date":"2025-07-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-02&host_type=src&vulnerability=cve-2024-20439","date":"2025-08-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-04&host_type=src&vulnerability=cve-2024-20439","date":"2025-08-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-06&host_type=src&vulnerability=cve-2024-20439","date":"2025-08-06"}],"evidenceTotal":272,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-798","name":"Use of Hard-coded Credentials"},{"id":"CWE-912","name":"Hidden Functionality"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20439","tags":["US Government Resource"]}],"techniques":[{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Hard-coded Credentials","mappingType":"exploitation_technique","evidence":[],"comment":"Due to static credentials found in Cisco Smart Licensing Utility, a remote, unauthenticated attacker can gain administrative access through the API.","confidence":"high"},{"id":"T1106","name":"Native API","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Hard-coded Credentials","mappingType":"primary_impact","evidence":[],"comment":"Due to static credentials found in Cisco Smart Licensing Utility, a remote, unauthenticated attacker can gain administrative access through the API.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-18154","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-18154","exploited":true,"exploitedSince":"2025-03-31","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2024-20439","name":"Hardcoded Admin Credentials For Cisco Smart Licensing Utility API","severity":"critical","path":"http/cves/2024/CVE-2024-20439.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20439.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1552"],"provenance":"source"},{"stage":"primary","techniques":["T1106"],"provenance":"source"}],"timeline":[{"date":"2024-09-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20439","provenance":"source"},{"date":"2025-02-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","provenance":"source"},{"date":"2025-03-31","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-31","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-18154","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":208},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 610 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}