EXPOSURES › CVE-2014-2120
CVE-2014-2120
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco ASA WebVPN XSS vulnerability allows remote script injection via unspecified parameter.
Cisco ASA WebVPN login page contained a cross-site scripting (XSS) flaw enabling remote attackers to inject arbitrary web scripts, posing a significant risk to DIB organizations relying on Cisco hardware for network security. This vulnerability was actively exploited in the wild, requiring immediate patching to prevent potential data exfiltration or lateral movement within protected networks.
Shame score — While actively exploited, the vulnerability was disclosed and patched relatively quickly without evidence of long-term negligence or mass data breach.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |