Cisco Smart Licensing Utility Static Credential Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 31/03/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| smart license utility | ≥ 2.0.0, < 2.3.0 | 2.3.0 |
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free