Cisco Smart Licensing Utility Vulnerabilities (CVE-2024-20439 and CVE-2024-20440)

CVE numbers CVE-2024-20439 and CVE-2024-20440

Multiple vulnerabilities in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to collect sensitive information or administer Cisco Smart Licensing Utility services on a system while the software is running.

These vulnerabilities affect systems if they are running a vulnerable release of Cisco Smart Licensing Utility, regardless of software configuration.

Note: These vulnerabilities are not exploitable unless Cisco Smart Licensing Utility was started by a user and is actively running.

Cisco has released software updates that address these vulnerabilities.

There are no workarounds that address these vulnerabilities.

CVE-2024-20439: Cisco Smart Licensing Utility Static Credential Vulnerability

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.

This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to log in to the affected system. A successful exploit could allow the attacker to log in to the affected system with administrative privileges over the API of the Cisco Smart Licensing Utility application.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s): CSCwi41731
CVE ID: CVE-2024-20439
Security Impact Rating (SIR): Critical
CVSS Base Score: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2024-20440: Cisco Smart Licensing Utility Information Disclosure Vulnerability

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.

This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s): CSCwi47950
CVE ID: CVE-2024-20440
Security Impact Rating (SIR): Critical
CVSS Base Score: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information – https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw