Alerts: CISA Adds One Known Exploited Vulnerability to Catalog

Mar 31, 2025

—

Source URL: https://www.cisa.gov/news-events/alerts/2025/03/31/cisa-adds-one-known-exploited-vulnerability-catalog
Source: Alerts
Title: CISA Adds One Known Exploited Vulnerability to Catalog

Feedly Summary: CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

CVE-2024-20439 Cisco Smart Licensing Utility Static Credential Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

AI Summary and Description: Yes

Summary: The text discusses a newly identified vulnerability, CVE-2024-20439 in the Cisco Smart Licensing Utility, added to CISA’s Known Exploited Vulnerabilities Catalog. This vulnerability poses significant risks to federal enterprises, urging agencies to remediate it as part of their cybersecurity protocol.

Detailed Description:
The text is a notification from the Cybersecurity and Infrastructure Security Agency (CISA) regarding a newly cataloged vulnerability. This vulnerability is part of a broader duty to mitigate risks associated with known exploited vulnerabilities, particularly within federal agencies.

Key Points:
– **CVE-2024-20439**: A static credential vulnerability in the Cisco Smart Licensing Utility is highlighted, which is actively being exploited by cyber actors.
– **Importance of the Vulnerability**: Such vulnerabilities are known to be frequent attack vectors, posing substantial risks to the security of the federal enterprise.
– **Binding Operational Directive (BOD) 22-01**: This directive mandates federal agencies to address identified vulnerabilities to safeguard their networks.
– Established the Known Exploited Vulnerabilities Catalog to systematically track high-risk CVEs.
– Requires Federal Civilian Executive Branch (FCEB) agencies to remediate vulnerabilities by a specified deadline.
– **Broader Implications**: While BOD 22-01 applies strictly to FCEB agencies, CISA advocates for all organizations to prioritize the remediation of vulnerabilities listed in the catalog to enhance their cybersecurity posture.
– **Ongoing Updates**: CISA will continue to update the catalog as new vulnerabilities are identified, reflecting the evolving landscape of cybersecurity threats.

This information is particularly relevant for security and compliance professionals as it emphasizes the need for prompt action regarding known vulnerabilities, the importance of following established directives, and the proactive measures organizations should adopt to counteract cyber threats.

01 1 2 2024 2025 24 3 4 5 a Act active exploitation active threats AI alerts alt and anti app art as attack attack vector attack vectors attacks based being Binding Operational Directive by C catalog CI CIA CISA Cisco Cisco Smart Licensing Utility co Col Common Vulnerabilities Common Vulnerabilities and Exposures compliance compliance professionals credential CVE cyber cyber actors cyber threat cyber threats cyberattack Cyberattacks cybersecurit Cybersecurity Cybersecurity and Infrastructure Security Agency Cybersecurity and Infrastructure Security Agency (CISA) cybersecurity posture cybersecurity threat cybersecurity threats D de directive e enterprise enterprises ERP event exp exploit Exploitation exploited vulnerabilities exploited vulnerability Exposures fact federal agencies Federal Civil Federal Civilian Executive Branch federal enterprise for g Gen Go H high Highlight HR http HTTPS implications in information infrastructure infrastructure security ite k Key Known Exploited Vulnerabilities Known Exploited Vulnerabilities Catalog known vulnerabilities l land led Li licensing Living low malicious cyber actors man management media N network networks news no o of on one only operation opt organization organizations point post proactive proactive measures professionals prompt protocol Q R rack RCE red remediation Risk risks Ro RoT s safe sec security security and compliance security posture security threat security threats Sig Smart Licensing Utility SoC source SSE SSO system T text the threat threats Time to Tor TP two type UI up update updates US V vectors vents vulnerabilities vulnerabilities catalog vulnerability Vulnerability Management vulnerability management practice Wi x