CVE-2014-2120

cisco adaptive_security_appliance_software

Published 19 Mar 2014 · updated 17 Jun 2026 · Analyzed

6.1 Medium · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 12 Nov 2024, with a remediation deadline of 3 Dec 2024 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

References

tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120 · Broken Link, Vendor Advisory
www.securityfocus.com/bid/66290 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1029935 · Broken Link, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120 · US Government Resource