This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco Smart Licensing Utility fixes 2 critical vulnerabilities
Cisco Smart Licensing Utility version 2.3.0 fixes 2 critical vulnerabilities [1]. The vulnerability CVE-2024-20439 has been added to CISA's Known Exploited Vulnerabilities catalog [2].
An unauthenticated remote attacker can gain full administrative access to the affected system using undocumented static user credentials [1].
The vulnerability is present in product:
- *:Cisco Smart Licensing Utility; <2.3.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-20439 at cve.org, NVD
- CWE-912: Hidden Functionality at cwe.mitre.org
The vulnerability was publicly disclosed 4. 9. 2024.
An unauthenticated remote attacker can obtain log files containing sensitive data by sending a specially crafted HTTP request to the affected device [1].
The vulnerability is present in product:
- *:Cisco Smart Licensing Utility; <2.3.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-20440 at cve.org, NVD
- CWE-532: Insertion of Sensitive Information into Log File at cwe.mitre.org
The vulnerability was publicly disclosed 4. 9. 2024.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 1. 4. 2025.