Full Report
Attackers have started targeting Cisco Smart Licensing Utility (CSLU) instances unpatched against a vulnerability exposing a built-in backdoor admin account. [...]
Analysis Summary
# Vulnerability: Critical Cisco Smart Licensing Utility Flaws Being Exploited
## CVE Details
- CVE ID: CVE-2024-20439 and CVE-2024-20440 (Chained exploitation mentioned)
- CVSS Score: Not explicitly listed, but described as "critical" and actively exploited.
- CWE: Not explicitly listed, but likely related to authentication bypass/backdoor credentials.
## Affected Systems
- Products: Cisco Smart Licensing Utility (CSLU)
- Versions: Specific vulnerable versions are not detailed in the excerpt, but the advisory covers versions with these flaws.
- Configurations: Instances exposed on the Internet.
## Vulnerability Description
The vulnerability involves the existence of security flaws (specifically mentioned as two chained flaws) within the Cisco Smart Licensing Utility (CSLU). One of the flaws appears to be a hardcoded static password used for a backdoor account, which was detailed after Cisco released patches. Threat actors are chaining these two vulnerabilities to gain unauthorized access.
## Exploitation
- Status: **Exploited in the wild** (Reported by SANS Technology Institute shortly after patch release).
- Complexity: Implied to be relatively low, given the public disclosure of PoC/details.
- Attack Vector: Network (targeting CSLU instances exposed on the Internet).
## Impact
Since the exploitation allows chaining flaws, the likely impact involves unauthorized access and control:
- Confidentiality: Likely High (due to potential access granted by backdoor credentials).
- Integrity: Likely High (potential to modify CSLU operation or related systems).
- Availability: Medium to High (remote compromise can lead to service disruption).
## Remediation
### Patches
- Patches were released by Cisco (See references for specific fix versions).
### Workarounds
- No specific workarounds are detailed in this excerpt, but the primary mitigation is immediate patching and ensuring CSLU instances are not exposed to the public Internet.
## Detection
- Detection is complicated as Cisco's PSIRT advisory mentioned they had found *no evidence* of exploitation at the time of their statement, contradictory to industry reports (SANS).
- Detection should focus on identifying abnormal activity related to the CSLU service, potentially looking for connection attempts from external sources or unexpected credential usage if the hardcoded password structure is known.
## References
- [Cisco Security Advisory for CVE-2024-20439 and CVE-2024-20440](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw) (Defanged)
- [SANS Technology Institute Report](https://isc.sans.edu/diary/rss/31782) (Defanged)