Cisco Smart Licensing Utility Information Disclosure Vulnerability

CVE-2024-20440

Summary

A vulnerability exists in the Cisco Smart Licensing Utility that allows remote attackers to access sensitive information via excessive verbosity in a debug log file. By sending a specially crafted HTTP request to the affected device, an unauthenticated attacker can exploit this issue to extract log files containing sensitive data, including credentials that could be exploited for unauthorized API access. Organizations using the affected versions should assess their exposure and consider implementing mitigations to prevent the unauthorized disclosure of sensitive information.

News Articles

Cyber Security Agency of Singapore

CVE-2024-20439CVE-2024-20440

Active Exploitation of Vulnerabilities in Cisco Smart Licensing Utility

There have been reports of active exploitation of vulnerabilities in unpatched Cisco Smart Licensing Utility instances.

4 weeks ago

The Cyber Express

CVE-2024-20439CVE-2024-20440

Urgent Patch Needed For CVE-2024-20439 And CVE-2024-20440

Cisco alerts users to critical vulnerabilities CVE-2024-20439 and CVE-2024-20440 in CSLU.

4 weeks ago

SecurityWeek

CVE-2024-20439CVE-2024-20440

Hackers Target Cisco Smart Licensing Utility Vulnerabilities

SANS is seeing attempts to exploit two critical Cisco Smart Licensing Utility vulnerabilities tracked as CVE-2024-20439 and CVE-2024-20440.

1 month ago

More News...

References