Cisco Smart Licensing Utility Vulnerability Let Attackers Gain Admin Control

Cisco has issued a security advisory (Advisory ID: cisco-sa-cslu-7gHMzWmw) regarding critical vulnerabilities in the Cisco Smart Licensing Utility.

These vulnerabilities could allow unauthenticated, remote attackers to gain administrative control over affected systems.

The advisory was first published on September 4, 2024, and highlights the severity of the issue with a CVSS score of 9.8.

Cisco has released software updates to address these vulnerabilities, but no workarounds are available.

Vulnerability Details

CVE-2024-20439: Static Credential Vulnerability

A critical vulnerability identified as CVE-2024-20439 exists in the Cisco Smart Licensing Utility.

This flaw is due to an administrative account’s undocumented, static user credential.

An attacker could exploit this vulnerability by using the static credentials to log in to the affected system, potentially gaining administrative privileges over the API of the Cisco Smart Licensing Utility application.

• Bug ID: CSCwi41731
• Security Impact Rating (SIR): Critical
• CVSS Base Score: 9.8
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2024-20440: Information Disclosure Vulnerability

Another critical vulnerability, CVE-2024-20440, could allow attackers to access sensitive information. This vulnerability arises from excessive verbosity in a debug log file.

By sending a crafted HTTP request to an affected device, an attacker could obtain log files containing sensitive data, including credentials to access the API.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14 day free trial

• Bug ID: CSCwi47950
• Security Impact Rating (SIR): Critical
• CVSS Base Score: 9.8
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

The vulnerabilities affect systems running a vulnerable release of Cisco Smart Licensing Utility. Notably, these vulnerabilities are not exploitable unless the utility is actively running.

Cisco has confirmed that the following products are not affected:

• Smart Software Manager On-Prem
• Smart Software Manager Satellite

Fixed Software

Cisco has released free software updates to address these vulnerabilities. Customers are encouraged to upgrade to the appropriate fixed software release.

The table below outlines the affected and fixed releases:

Cisco Smart License Utility Release	First Fixed Release
2.0.0	Migrate to a fixed release.
2.1.0	Migrate to a fixed release.
2.2.0	Migrate to a fixed release.
2.3.0	Not vulnerable.

As of the advisory’s publication, the Cisco Product Security Incident Response Team (PSIRT) is unaware of any public announcements or malicious use of these vulnerabilities.

Cisco’s advisory underscores the critical nature of the vulnerabilities in the Smart Licensing Utility.

Organizations using affected versions should prioritize updating their systems to mitigate potential risks.

Customers can contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers for further assistance.

What Does MITRE ATT&CK Expose About Your Enterprise Security? - Watch Free Webinar!