Cisco warns of backdoor admin account in Smart Licensing Utility

Cisco patched two critical vulnerabilities in the Cisco Smart Licensing Utility: CVE-2024-20439, an undocumented static administrative credential that could allow unauthenticated remote administrative access, and CVE-2024-20440, an information-disclosure bug that can expose log files and API credentials; administrators are advised to migrate to fixed releases (2.3.0 is not vulnerable) and Cisco reports no evidence of exploitation to date.