Cisco Smart License Utility vulnerabilities

2 CVEs affecting Cisco Smart License Utility, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-20440, published 2024-09-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-20439: Cisco Smart Licensing Utility Static Credential Vulnerability, published 2024-09-04. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-03-31. EPSS: 97.1% chance of exploitation in the next 30 days. A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This…
CVE-2024-20440, published 2024-09-04. High severity, CVSS 7.5. EPSS: 51.9% chance of exploitation in the next 30 days. A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log…