CVE-2024-20440: Cisco Smart Licensing Utility log leaks credentials to unauthenticated attackers
The short version: Cisco Smart Licensing Utility (CSLU) writes an excessively verbose debug log that an unauthenticated attacker can retrieve with a crafted HTTP request (CVE-2024-20440). The log contains sensitive data — including credentials that can be used to reach the API. On its own it's an information leak; next to its sibling CVE-2024-20439 (a hardcoded admin account), it's part of a clean path to control. The fix is a version upgrade. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — an unauthenticated credential leak |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS (Cisco, CNA) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | ~51.5% · 98.8th percentile (2026-07-17) |
| In CISA KEV? | No — not individually listed (its sibling CVE-2024-20439 is) |
| Known exploited? | Reported exploited alongside CVE-2024-20439; not separately KEV-listed |
| Vulnerability type | CWE-532 insertion of sensitive information into a log file → unauthenticated information disclosure |
| Requires authenticated session? | No — pre-authentication |
| Affected | Cisco Smart Licensing Utility 2.0.0, 2.1.0, 2.2.0 (only while the CSLU application is actively running) |
| Fixed in | Cisco Smart Licensing Utility 2.3.0 and later |
What you need to know
CSLU is a lightweight Windows utility for managing Cisco smart-licensing on-premises. In the affected releases it logs too much: a debug log file records sensitive information, and an unauthenticated attacker who sends a crafted HTTP request to the running utility can read that log back.
The reason this matters more than a generic "verbose logging" note is what's in the log: credentials that can then be used against the CSLU API.
- How they find it — internet-wide scanning surfaces exposed CSLU instances; the log endpoint is reachable without authentication.
- How they use it — pull the debug log, harvest the credentials it contains.
- What it leads to — API access, and — combined with the hardcoded-credential flaw (CVE-2024-20439) in the same utility — a straightforward route to administrative control.
How serious we see it
High — because the disclosed "information" is authentication material.
On paper this is a 7.5 confidentiality-only issue, and we don't overstate it: it isn't a direct code-execution bug, and it isn't individually in KEV. But an unauthenticated leak of credentials on a management utility behaves like the first half of an access chain — and its sibling flaw supplies the second half. The bounded, reassuring part: it affects three specific CSLU releases, only while the utility is running, a fixed build exists, and confirming exposure is quick.
Recommendations
Straight from Cisco's advisory (cisco-sa-cslu-7gHMzWmw):
- Upgrade now. Move to Cisco Smart Licensing Utility 2.3.0 or later, which resolves this along with CVE-2024-20439.
- Confirm exposure first. Verify whether CSLU is installed, whether it's reachable from untrusted networks, and which version.
- Don't leave it listening. Run CSLU only when actively managing licenses; keep it off the public internet.
- Rotate what leaked. If you ran an affected build reachable to untrusted networks, treat credentials the CSLU host handled as exposed and rotate them.
- Hunt. Review logs for retrieval of the debug log and for follow-on API activity.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers exposed Cisco licensing interfaces, fingerprints the product and version, and flags exposure tied to this CSLU flaw and its actively exploited, KEV-listed sibling — so a forgotten licensing utility surfaces in your results rather than in someone else's logs.
The value of a continuous attacker's-eye view is catching the quiet ones: a utility stood up for a one-time task and left reachable is precisely the asset that leaks credentials before anyone remembers it's there.