CVE-2024-20439

Name of the Vulnerable Software and Affected Versions Cisco Smart Licensing Utility versions 2.0.0 through 2.2.0

Description A vulnerability exists due to an undocumented static user credential for an administrative account. An unauthenticated remote attacker can use these static credentials to log into an affected system, granting them administrative privileges over the Cisco Smart Licensing Utility application API. This issue is exploitable while the utility is actively running. Real-world exploitation of this flaw has been observed.

Recommendations Upgrade to version 2.3.0 or later. Investigate previously exposed or running instances for unexpected API or administrative activity.