CVE-2024-20439

CRITICAL Year: 2024
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-912
View all →

Vulnerability Description

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.

Related Vulnerabilities

CVE-2020-12504

CRITICAL
CVSS:9.8(Critical)

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT...

CWE-9122020

CVE-2020-14487

CRITICAL
CVSS:9.8(Critical)

OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitr...

CWE-9122020

CVE-2020-16204

CRITICAL
CVSS:9.8(Critical)

The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versi...

CWE-9122020

CVE-2021-24867

CRITICAL
CVSS:9.8(Critical)

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are af...

CWE-9122021

CVE-2021-43987

CRITICAL
CVSS:9.8(Critical)

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regu...

CWE-9122021

CVE-2022-3203

CRITICAL
CVSS:9.8(Critical)

On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get ...

CWE-9122022