CISA Warns of Cisco Smart Licensing Utility Credential Vulnerability Exploited in Attacks

CISA added CVE-2024-20439—an undocumented static administrative credential in the Cisco Smart Licensing Utility—to its Known Exploited Vulnerabilities list after confirmation of active exploitation; the flaw (CVSS 9.8) allows unauthenticated remote administrative access and is often chained with CVE-2024-20440 to harvest sensitive data. Affected CSLU versions are 2.0.0–2.2.0 (2.3.0 is not vulnerable); CISA requires remediation for federal agencies and recommended mitigations include updating to 2.3.0, network segmentation, and monitoring for unauthorized access.