Cisco patched this security flaw (CVE-2024-20439) in September, describing it as "an undocumented static user credential for an administrative account" that lets unauthenticated attackers log into unpatched systems remotely with admin privileges over the Cisco Smart Licensing Utility (CSLU) app's API. While Cisco didn't share any details on these attacks, Johannes Ullrich, SANS Technology Institute's Dean of Research, spotted a campaign last month that used the backdoor admin account to attack CSLU instances exposed online. Aruba threat researcher Nicholas Starke reverse-engineered the vulnerability two weeks after Cisco released security patches and published a write-up with technical details (including the decoded hardcoded static password). Cisco has warned admins to patch a critical Cisco Smart Licensing Utility (CSLU) vulnerability, which exposes a built-in backdoor admin account now used in attacks. Ullrich said in March that threat actors are chaining CVE-2024-20439 with a second flaw, a critical CLSU information disclosure vulnerability (CVE-2024-20440) that unauthenticated attackers can exploit to gain access to log files containing sensitive data (including API credentials) by sending crafted HTTP requests to vulnerable devices. This isn't the first backdoor account removed from Cisco products in recent years, with previous hardcoded credentials found in its IOS XE, Wide Area Application Services (WAAS), Digital Network Architecture (DNA) Center, and Emergency Responder software. CVE-2024-20439 only impacts systems running vulnerable Cisco Smart Licensing Utility releases, but it's only exploitable if the user starts the CSLU app (which doesn't run in the background by default). "A quick search didn't show any active exploitation [at the time], but details, including the backdoor credentials, were published in a blog by Nicholas Starke shortly after Cisco released its advisory. "In March 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability in the wild," the company said in a Tuesday update to the original security advisory. On Monday, CISA added the CVE-2024-20439 static credential vulnerability to its Known Exploited Vulnerabilities Catalog, ordering U.S. federal agencies to secure their systems against active exploitation within three weeks, by April 21. CSLU is a Windows app for managing licenses and linked products on-premises without connecting them to Cisco's cloud-based Smart Software Manager solution.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 02 Apr 2025 13:20:08 +0000