# CVE-2024-20439

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.

- Page: https://www.vulneraibility.com/cve/CVE-2024-20439
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2025-03-31; CISA due date 2025-04-21
- EPSS: 97.09%
- Detection templates only, no public exploit found: 1 Nuclei template
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-03-31)
- Weakness: CWE-912
- Published: 2024-09-04

## Affected versions

- Cisco Cisco Smart License Utility: affected 2.1.0; 2.0.0; 2.2.0

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20439

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.