Exploitation evidence
Known exploited · CISA KEV listed
Added 2025-03-31. Ransomware campaign use: Unknown.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: 2025-04-21. This is the catalog’s deadline, not an assessment of your organization’s exposure.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
Cisco / Cisco Smart License Utility
Default status: Not specified
- affected: 2.1.0
- affected: 2.0.0
- affected: 2.2.0
Fixes and workarounds
No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.
Sources and related reporting
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.9709,
"percentile": 0.99893
}10 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.9709,
"percentile": 0.99892
}09 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-09",
"epss": 0.9709,
"percentile": 0.99893
}08 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-08",
"epss": 0.9709,
"percentile": 0.99893
}07 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-07",
"epss": 0.9709,
"percentile": 0.99892
}06 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-06",
"epss": 0.9709,
"percentile": 0.99893
}06 Nov 2026, 06:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-05",
"epss": 0.9709,
"percentile": 0.99892
}04 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-04",
"epss": 0.9709,
"percentile": 0.99893
}04 Nov 2026, 12:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:cisco_smart_license_utility:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cisco_smart_license_utility",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:cisco_smart_license_utility:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cisco_smart_license_utility",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:cisco_smart_license_utility:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cisco_smart_license_utility",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.2.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20439",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-31T18:12:06.667412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-03-31",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20439"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:55:46.010Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20439"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-31T00:00:00.000Z",
"value": "CVE-2024-20439 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Smart License Utility",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.\r\n\r This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API."
}
],
"exploits": [
{
"lang": "en",
"value": "In March 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "Hidden Functionality",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-01T21:36:38.960Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-cslu-7gHMzWmw",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw"
}
],
"source": {
"advisory": "cisco-sa-cslu-7gHMzWmw",
"defects": [
"CSCwi41731"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20439",
"datePublished": "2024-09-04T16:28:39.669Z",
"dateReserved": "2023-11-08T15:08:07.670Z",
"dateUpdated": "2025-10-21T22:55:46.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}03 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-03",
"epss": 0.9709,
"percentile": 0.99893
}03 Nov 2026, 02:22 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-02",
"epss": 0.9709,
"percentile": 0.99893
}03 Nov 2026, 02:22 Jerusalem · CISA KEV status changed
Stored KEV snapshot at this observation.
{
"cveID": "CVE-2024-20439",
"cwes": [
"CWE-912"
],
"dateAdded": "2025-03-31",
"dueDate": "2025-04-21",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Unknown",
"notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw ; https://nvd.nist.gov/vuln/detail/CVE-2024-20439",
"product": "Smart Licensing Utility",
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.",
"vendorProject": "Cisco",
"vulnerabilityName": "Cisco Smart Licensing Utility Static Credential Vulnerability"
}