CVE-2024-20439: Cisco Smart Licensing Utility hard-coded admin credential allows remote login

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote admin access via a static credential, listed in CISA KEV with a 99.8th percentile EPSS score.

What it is

Cisco Smart Licensing Utility (CSLU) contains an undocumented static credential for an administrative account. An unauthenticated remote attacker who knows or guesses this credential can log into the CSLU application API with administrative rights. Because the credential is static, it cannot be rotated by defenders and affects every deployment of the vulnerable utility.

Impact

An attacker gains administrative access to the CSLU application API, allowing full control over the application's licensing functions and any data or configuration it manages. This is a complete compromise of confidentiality, integrity and availability of the CSLU application.

Attack surface

Reachable over the network via the CSLU application API with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed CSLU instance is a candidate target.

Exploitation

CVE-2024-20439 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2025-03-31) and has an EPSS 30-day probability of 0.92062 (99.8th percentile), indicating active exploitation and very high likelihood of attempted exploitation. No ransomware campaign use is documented.

What to do

• Apply the Cisco security advisory fix for CSLU as the first action; consult cisco-sa-cslu-7gHMzWmw for the patched release.
• If a patch is not yet available, follow Cisco's mitigations or discontinue use of the product, per CISA BOD 22-01 guidance.
• Remove CSLU from direct internet exposure and restrict API access to trusted management networks only.
• Audit CSLU administrative accounts and logs for unexpected logins, and rotate any credentials that may have been exposed.
• Track CISA KEV remediation due date (2025-04-21) and confirm closure.

Detection

• Monitor CSLU application API authentication logs for successful logins from unexpected source IPs or at unusual times.
• Alert on use of the static administrative account or any login that does not map to a known, individually assigned administrator.
• Baseline normal CSLU API call patterns and flag anomalous administrative actions or configuration changes.
• Search network telemetry for external hosts reaching CSLU management ports.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.