Backdoor Secrecy

Hardcoded Password Flaw and Log File Exposure

The Cisco Secure SD-WAN (CSLU) has been affected by two critical vulnerabilities, identified as CVE-2024-20439 and CVE-2024-20440. These vulnerabilities could be exploited to compromise the security of the app and obtain sensitive data.

CVE-2024-20439: Hardcoded Password Flaw

This flaw, identified as CVE-2024-20439, is a hardcoded password flaw that can be exploited to achieve administrator privileges via the app’s API. This vulnerability has a CVSS score of 9.8, indicating a high severity level.

CVE-2024-20440: Log File Exposure

This flaw, identified as CVE-2024-20440, allows an attacker to obtain log files containing sensitive data such as API credentials. This vulnerability also has a CVSS score of 9.8, making it a high-severity issue.

Amplifying the Danger

The two vulnerabilities could be used together to amplify their danger, making patching even more imperative. The affected versions of CSLU are 2.0.0, 2.1.0, and 2.2.0; version 2.3.0 is the patched version.

Cisco’s History of Flaws

CSLU is a recent product, but Cisco has a history of similar flaws in its products. Hardcoded credentials have been discovered in Cisco Firepower Threat Defense, Emergency Responder, and Digital Network Architecture (DNA) Center, to name a few of the affected products.

SANS’ Perspective

Ullrich of SANS wrote sarcastically, “The first one [CVE-2024-20439] is one of the many backdoors Cisco likes to equip its products with.”

Conclusion

In conclusion, the hardcoded password flaw and log file exposure in CSLU are critical vulnerabilities that require immediate attention. It is essential to patch the affected versions of CSLU to prevent exploitation and maintain the security of the app.

FAQs

Q: What are the affected versions of CSLU?

A: The affected versions of CSLU are 2.0.0, 2.1.0, and 2.2.0.

Q: What is the patched version of CSLU?

A: The patched version of CSLU is 2.3.0.

Q: What is the CVSS score for each vulnerability?

A: Both CVE-2024-20439 and CVE-2024-20440 have a CVSS score of 9.8, indicating high severity.

Q: Is it possible to exploit the vulnerabilities together?

A: Yes, the two vulnerabilities could be used together to amplify their danger, making patching even more imperative.

Q: What is the history of similar flaws in Cisco products?

A: Cisco has a history of similar flaws in its products, including hardcoded credentials in Cisco Firepower Threat Defense, Emergency Responder, and Digital Network Architecture (DNA) Center, to name a few.