Coverage › CVE-2024-20439

CVE-2024-20439 Mapped Sigma

Cisco Smart Licensing Utility Static Credential Vulnerability

Vendor / product

Cisco — Smart Licensing Utility

Description (CISA)

Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.

Added to KEV

2025-03-31

Due date

2025-04-21

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-912

CISA notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw
https://nvd.nist.gov/vuln/detail/CVE-2024-20439

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1106 Native API primary impact

• DET0529 Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls
  AN1465 Windows

  Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: DllName Image TargetProcess
  AN1466 Linux

  Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.

  auditd:SYSCALL execve, fork, mmap, ptrace → DC0035 Process Access

  auditd:SYSCALL module load or memory map path → DC0016 Module Load

  Tunable: SyscallType ProcessName MAPS Path
  AN1467 macOS

  Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.

  macos:unifiedlog launch and dylib load → DC0016 Module Load

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation

  Tunable: API Framework Name Execution Context

Sigma rules tagged attack.t1106 (14)

T1552 Unsecured Credentials exploitation technique

• DET0412 Detect Access or Search for Unsecured Credentials Across Platforms
  AN1153 Windows

  Unusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: TimeWindow SuspiciousProcessList
  AN1154 Linux

  Reading of sensitive files like .bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.

  auditd:SYSCALL open/read system calls to ~/.bash_history or /etc/shadow → DC0055 File Access

  auditd:SYSCALL execution of tools like cat, grep, or awk on credential files → DC0064 Command Execution

  Tunable: SensitivePaths UserContext
  AN1155 macOS

  Unusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.

  macos:unifiedlog read access to ~/Library/Keychains or history files by terminal processes → DC0055 File Access

  macos:unifiedlog execution of 'security', 'cat', or 'grep' commands accessing credential storage → DC0064 Command Execution

  Tunable: ProcessName TargetPath
  AN1156 SaaS

  Unusual web-based access or API scraping of password managers, single sign-on sessions, or credential sync services via browser automation or anomalous API tokens.

  saas:googleworkspace Accessed third-party credential management service → DC0002 User Account Authentication

  saas:zoom unusual web session tokens and automation patterns during login → DC0038 Application Log Content

  Tunable: TokenAnomalyThreshold AccessGeoLocation
  AN1157 Identity Provider

  Unauthorized API or console calls to retrieve or reset password credentials, download key material, or modify SSO settings.

  azure:signinlogs Reset password or download key from portal → DC0002 User Account Authentication

  AWS:CloudTrail GetSecretValue → DC0070 Cloud Service Metadata

  Tunable: SSOSettingScope SecretType
  AN1158 Containers

  Access to container image layers or mounted secrets (e.g., Docker secrets) by processes not tied to entrypoint or orchestration context.

  auditd:SYSCALL read of /run/secrets or docker volumes by non-entrypoint process → DC0055 File Access

  containerd:Events unusual process spawned from container image context → DC0032 Process Creation

  Tunable: EntrypointAllowlist VolumeMountPath
  AN1159 Network Devices

  Use of configuration backup utilities or CLI access to dump plaintext passwords, local user hashes, or SNMP strings.

  linux:syslog CLI access to 'show running-config', 'show password', or 'cat config.txt' → DC0064 Command Execution

  NSM:Flow large transfer from management IPs to unauthorized host → DC0085 Network Traffic Content

  Tunable: ManagementInterfaceIPs CommandPattern

Sigma rules tagged attack.t1552 (13)