Backdoor secrecy
The hardcoded password flaw, recognized as CVE-2024-20439, could possibly be exploited to attain administrator privileges by way of the app’s API. The second flaw, CVE-2024-20440, might enable an attacker to acquire log recordsdata containing delicate knowledge equivalent to API credentials.
With each given an equivalent CVSS rating of 9.8, it’s a toss-up as to which is the worst of the 2. Nonetheless, the vulnerabilities might clearly be used collectively in ways in which amplify their hazard, making patching much more crucial. The affected variations of CSLU are 2.0.0, 2.1.0, and a pair of.2.0; model 2.3.0 is the patched model.
CSLU is a latest product, so one may need anticipated it to be higher secured. That stated, Cisco has a historical past of this sort of flaw, with hardcoded credentials being found in Cisco Firepower Risk Protection, Emergency Responder, and additional again in Digital Community Structure (DNA) Middle, to call solely a number of the affected merchandise.
As Ullrich of the SANS wrote moderately sarcastically within the group’s new warning: “The primary one [CVE-2024-20439] is likely one of the many backdoors Cisco likes to equip its merchandise with.”
