U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Smart Licensing Utility flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Smart Licensing Utility vulnerability, tracked as CVE-2024-20439, to its Known Exploited Vulnerabilities (KEV) catalog.
Last week, Cisco disclosed two vulnerabilities in its Smart Licensing Utility: CVE-2024-20439, a static credential backdoor, and CVE-2024-20440, an information disclosure flaw. Attackers can exploit the backdoor to access sensitive log files. While no active exploitation was initially observed, the publication of exploit details has led to recent attack activity.
“Multiple vulnerabilities in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to collect sensitive information or administer Cisco Smart Licensing Utility services on a system while the software is running.” reads the advisory.
Below are the descriptions of the two vulnerabilities:
- CVE-2024-20439 (CVSS score: 9.8) – The flaw is related to the presence of an undocumented static admin credential, allowing attackers to log in with administrative privileges via the Cisco Smart Licensing Utility API.
- CVE-2024-20440 (CVSS score: 9.8) – The vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this issue by sending a specially crafted HTTP request to an affected device and obtain log files that contain sensitive data, including credentials that can be used to access the API.
The IT giant also released software updates that address these flaws. There are no workarounds to address the two issues.
Researchers at SANS Internet Storm Center warned that the two issues are actively exploited in attacks.
“These two vulnerabilities are somewhat connected. The first one is one of the many backdoors Cisco likes to equip its products with. A simple fixed password that can be used to obtain access. The second one is a log file that logs more than it should. Using the first vulnerability, an attacker may access the log file.” reads the advisory published by SANS. “A quick search didn’t show any active exploitation, but details, including the backdoor credentials, were published in a blog by Nicholas Starke shortly after Cisco released its advisory [2]. So it is no surprise that we are seeing some exploit activity”
SANS researchers warned that the group attempting to exploit the two vulnerabilities is also targeting configuration files and possibly CVE-2024-0305 (CVSS score: 5.3), likely exploiting a DVR vulnerability.
SANS’s advisory does not provide information about the identity or motivation of the attackers exploiting the two flaws.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by April 21, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Cisco Smart Licensing Utility vulnerability)
