Unauthenticated Remote Attackers Can Log in to Cisco Systems with Administrative Privileges

CVE-2024-20439

Summary

A significant vulnerability exists in the Cisco Smart Licensing Utility due to the presence of an undocumented static user credential for an administrative account. This flaw allows an attacker to remotely log into an affected system without authentication, by utilizing these static credentials. Once inside, the attacker gains administrative privileges through the API of the application, potentially compromising the system's integrity and security. Organizations utilizing this software are urged to assess their security measures and implement necessary patches as detailed in the security advisory.

References