CVE-2024-20440

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 51.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-09-04 · updated 2026-06-17
Weakness: CWE-532

Description

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.

Affected products

Cisco Smart License Utility: 2.0.0, 2.1.0, 2.2.0

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw

Get alerted when CVE-2024-20440 or the next vulnerability affects your stack