CVE-2024-20440: Cisco Smart License Utility Disclosure Flaw

CVE-2024-20440 Overview

CVE-2024-20440 is an information disclosure vulnerability in the Cisco Smart Licensing Utility (CSLU). An unauthenticated remote attacker can retrieve sensitive data, including API credentials, by sending a crafted HTTP request to an affected device. The flaw stems from excessive verbosity in a debug log file, classified under [CWE-532] Insertion of Sensitive Information into Log File.

The vulnerability affects CSLU versions 2.0.0, 2.1.0, and 2.2.0. Exploitation requires no authentication, no user interaction, and can be performed over the network.

Critical Impact

Unauthenticated remote attackers can obtain log files containing credentials usable to access the CSLU API, enabling further compromise of license-managed infrastructure.

Affected Products

• Cisco Smart License Utility 2.0.0
• Cisco Smart License Utility 2.1.0
• Cisco Smart License Utility 2.2.0

Discovery Timeline

• 2024-09-04 - CVE-2024-20440 published to the National Vulnerability Database (NVD)
• 2024-09-19 - Last updated in NVD database

Technical Details for CVE-2024-20440

Vulnerability Analysis

The Cisco Smart Licensing Utility writes verbose debug information to a log file during normal operation. This log file contains credentials and other sensitive material that should not be persisted in plaintext. Because the file is reachable through the application's HTTP interface, an attacker can request it without authenticating.

The disclosed credentials grant access to the CSLU API. With API access, an attacker can interact with licensing functions and pivot toward systems that rely on Smart Licensing for entitlement and configuration.

The vulnerability impacts confidentiality only. Integrity and availability are not directly affected, but the leaked credentials can support follow-on attacks. The EPSS probability of 78.37% places this issue in the 99th percentile, indicating very high observed exploitation likelihood.

Root Cause

The root cause is improper handling of sensitive information in application logs ([CWE-532]). Debug logging in CSLU records API credentials and related secrets in cleartext. The log file remains accessible through the HTTP service without authentication checks, combining a logging defect with an access control gap.

Attack Vector

Exploitation requires only network reachability to the CSLU HTTP listener. An attacker sends a crafted HTTP request targeting the debug log resource and parses the response for credential material. No prior access, account, or user interaction is needed. The attacker can then authenticate to the CSLU API using the harvested credentials, which is the behavior also abused by the closely related authentication issue tracked as CVE-2024-20439.

No public proof-of-concept code is referenced in the enriched data, so the exploitation mechanism is described in prose rather than reproduced here. See the Cisco Security Advisory for vendor technical details.

Detection Methods for CVE-2024-20440

Indicators of Compromise

• Unexpected HTTP GET requests to CSLU log file paths from external or unmanaged sources.
• CSLU API authentication events originating from IP addresses that have not previously interacted with the licensing service.
• Outbound connections from the CSLU host to unfamiliar destinations following log file access.

Detection Strategies

• Inspect web server and proxy logs for HTTP requests targeting CSLU debug log filenames or directories.
• Correlate successful CSLU API authentications with prior HTTP retrievals of log resources from the same source IP.
• Alert on access to the CSLU HTTP listener from any network segment that is not explicitly authorized to manage licensing.

Monitoring Recommendations

• Restrict and monitor management network access to hosts running CSLU versions 2.0.0 through 2.2.0.
• Forward CSLU host, web, and authentication logs to a centralized analytics platform for retention and correlation.
• Rotate and audit any credentials referenced by CSLU after confirming the host has been patched.

How to Mitigate CVE-2024-20440

Immediate Actions Required

• Upgrade Cisco Smart Licensing Utility to a fixed release per the Cisco Security Advisory; no workarounds are available from the vendor.
• Stop the CSLU process when it is not actively in use, since the service only listens when explicitly started by an administrator.
• Rotate all credentials handled by CSLU, including API and Smart Account credentials that may have been written to debug logs.
• Review access logs for the CSLU HTTP listener to identify prior unauthorized retrieval of log files.

Patch Information

Cisco has released fixed software addressing CVE-2024-20440. Refer to the Cisco Security Advisory cisco-sa-cslu-7gHMzWmw for the specific fixed versions and upgrade guidance. Versions 2.0.0, 2.1.0, and 2.2.0 are vulnerable and must be replaced with a fixed release.

Workarounds

• No vendor workarounds exist; patching is the only supported remediation path.
• As an interim measure, ensure CSLU is not running unless required, since the vulnerability is exploitable only while the service is active.
• Place the CSLU host behind network controls that restrict inbound HTTP access to trusted administrative sources.

# Verify the installed CSLU version on the host (Windows PowerShell)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Smart License*Utility*" } |
  Select-Object DisplayName, DisplayVersion

# Stop the CSLU service when not actively used
Stop-Process -Name "CSLU" -Force