Vulnerability Intelligence Report
CVE-2024-20440
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.
Nuclei Template
CVSS Base Score
7.5
HIGH
Exploitability:3.9
Impact Score:3.6
EPSS Probability:51.47%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-532 ↗Insertion of Sensitive Information into Log File
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Cisco | Cisco Smart License Utility | 2.1.0 (affected), 2.0.0 (affected), 2.2.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cisco Systems, Inc. · Hosted Service · USA |
| Reserved | 2023-11-08T15:08:07 |
| Published | 2024-09-04T16:28:49 |
| Last Updated | 2025-04-01T21:47:09 |
Community Chatter & Buzz