- Security researchers claim that two Cisco Smart Licensing Utility Bugs are abused in Nature
- One of the errors is a hard -coded admin account
- Both bugs were fixed in 2024 so users had to update now
Cyber criminals abuse two vulnerabilities found in Cisco Smart Licensing Utility (CSLU) to unknown ends.
Johannes Ullrich, Dean of Research at the Sans Technology Institute, noted threat players now linking the two security errors to target Internet-exposed CSLU cases.
“A quick search did not show any active exploitation at the time, but details, including the backdoor’s credentials, were published in a blog by Nicholas Starke shortly after Cisco released his advice. So it’s no surprise that we see some exploitation activities,” Ullrich said.
No solutions
CSLU is a tool that helps organizations manage and report the use of Cisco software licenses in a more flexible and automated way.
It allows devices to connect to CISCO’s smart license system, either directly or through a local satellite server, to detect and track rights without requiring constant Internet access.
In September 2024, Cisco Patching CVE-2024-20439 announced, “undocumented static user information for an administrative account”, which is a fancy way of saying someone left hard-coded admin credentials in the rear.
The vulnerability allowed threat actors to log on to vulnerable systems externally, over the API or CSLU app.
At the same time, Cisco CVE-2024-20440, a vulnerability of information information used by threat actors used to access logs with sensitive information such as API credentials.
Abusing these deficiencies is not as straightforward, the diapering computer notes as it requires the victim to run the CSLU app in the background, which is not its default setting.
In any case, both vulnerabilities were patched and there are no solutions, so the only way to ensure your occurrences is to use the patch.
In the security counseling for the shortcomings Cisco said it was “not aware of” any public messages or malicious use, which means the pages have not yet been updated.
Via Bleeping computer
