Cisco Smart Licensing Utility Flaws Actively Exploited in the Wild

Experts are sounding the alarm after discovering that two recently patched security vulnerabilities in Cisco's Smart Licensing Utility have been actively exploited in real-world attacks. The flaws, CVE-2024-20439 and CVE-2024-20440, were disclosed by Cisco just last month, but researchers at SANS Internet Storm Center warn that attackers are already taking advantage of them.

The vulnerabilities in question are a static credential backdoor (CVE-2024-20439) and an information disclosure flaw (CVE-2024-20440). The first vulnerability allows an attacker to access sensitive log files, while the second one could be used to collect sensitive information or even administer Cisco Smart Licensing Utility services on a system while it's running.

Cisco has already released software updates to address these flaws, but there are currently no workarounds available for users. The good news is that Cisco is actively working on patches, and experts expect them to be deployed soon.

The Connection Between the Two Vulnerabilities

SANS researchers have noted that the two vulnerabilities are somewhat connected. "The first one is one of the many backdoors Cisco likes to equip its products with," they explain. "A simple fixed password that can be used to obtain access." The second vulnerability, on the other hand, is a log file that logs more than it should.

Using the first vulnerability, an attacker may be able to access the log file, which could potentially contain sensitive information.

The Attackers: What Do We Know?

Researchers at SANS warn that the attackers exploiting these vulnerabilities are also targeting configuration files and possibly CVE-2024-0305 (CVSS score: 5.3), likely exploiting a DVR vulnerability. However, the identity or motivation of the attackers is currently unknown.

The Importance of Keeping Up with Security Patches

"A quick search didn't show any active exploitation, but details, including the backdoor credentials, were published in a blog by Nicholas Starke shortly after Cisco released its advisory," notes SANS. "So it is no surprise that we are seeing some exploit activity." This highlights the importance of keeping up with security patches and staying informed about newly discovered vulnerabilities.

Experts warn that these types of attacks can be devastating, especially for organizations that rely on Cisco's Smart Licensing Utility for their IT infrastructure. It's essential to stay vigilant and take proactive steps to protect against these kinds of threats.

Stay Safe Online

To ensure your online safety, make sure you're keeping all software up-to-date, including operating systems, applications, and firmware. Regularly back up your data and consider implementing additional security measures such as antivirus software, firewalls, and intrusion detection systems.

Follow us on Twitter: @securityaffairs and Facebook and Mastodon (SecurityAffairs – hacking, Cisco Smart Licensing Utility) for the latest cybersecurity news and updates.