Cisco Smart Licensing Utility Information Disclosure Vulnerability

CVE-2024-20440

Summary

A vulnerability exists in the Cisco Smart Licensing Utility that allows remote attackers to access sensitive information via excessive verbosity in a debug log file. By sending a specially crafted HTTP request to the affected device, an unauthenticated attacker can exploit this issue to extract log files containing sensitive data, including credentials that could be exploited for unauthorized API access. Organizations using the affected versions should assess their exposure and consider implementing mitigations to prevent the unauthorized disclosure of sensitive information.

References