Cisco Smart Licensing Utility Static Credential Vulnerability
Cisco — Smart Licensing Utility
- Added to KEV catalog
- 31 March 2025
- Federal remediation due date
- 21 April 2025
- Weakness classification (CWE)
- CWE-912
CISA Description
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw ; https://nvd.nist.gov/vuln/detail/CVE-2024-20439
More Cisco Vulnerabilities
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services