5.4Mittel KEV

CVE-2014-2120Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

cisco adaptive_security_appliance_software Veröffentlicht: 2014-03-19 03:00 (vor 12 Jahren)

Bekannt ausgenutzt — Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

CISA hat am 12.11.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.12.2024.

Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120 ; https://nvd.nist.gov/vuln/detail/CVE-2014-2120

Beschreibung

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
cisco	adaptive_security_appliance_software	0

Referenzen und Patches

1029935 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
20140318 Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability vendor-advisoryBroken LinkVendor Advisory
66290 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120 US Government Resource

CPE-Treffer (NVD) (1)

cpe:2.3:o:cisco:adaptive_security_appliance_software:-:*:*:*:*:*:*:*

CVSS-Score

5.4Mittel

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Erforderlich
Geltungsbereich: Geändert
Vertraulichkeit: Niedrig
Integrität: Niedrig
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Alle Scores (4)

CISA-ADP	CVSS 3.1	5.4Mittel
nvd	CVSS 3.1	6.1Mittel
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.4Mittel
nvd	CVSS 2.0	4.3Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

22.56%

höher als 98 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2014-02-25
Veröffentlicht2014-03-19 03:00
Bei IP-DB eingegangen2026-10-24 23:30
In KEV aufgenommen2024-11-12
Zuletzt aktualisiert2026-06-17 03:06

Vergeben von (CNA): cisco
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Cisco IOS / IOS XE / ASA

8.6Hoch

CVE-2026-76418 KEV vor 18 Tagen

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unex…

7.5Hoch

CVE-2026-76505 vor 25 Tagen

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability

Cisco Cisco IOS XR Software

A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, r…

5.8Mittel

CVE-2026-76489 vor 25 Tagen

Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection…

5.3Mittel

CVE-2026-76445 vor 25 Tagen

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulner…

7.5Hoch

CVE-2026-20356 vor 25 Tagen

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…

7.5Hoch

CVE-2026-20236 vor 25 Tagen

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software