CVE-2009-1202

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-06-25 · updated 2026-06-16
Weakness: CWE-79

Description

WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks, by modifying the first hex-encoded character in a /+CSCO+ URI, aka Bug ID CSCsy80705.

Affected products

Cisco Adaptive Security Appliance: 8.0(4), 8.1.2, 8.2.1

References

http://secunia.com/advisories/35511
http://www.securityfocus.com/archive/1/504516/100/0/threaded
http://www.securityfocus.com/bid/35480
http://www.securitytracker.com/id?1022457
http://www.vupen.com/english/advisories/2009/1713
http://secunia.com/advisories/35511
http://www.securityfocus.com/archive/1/504516/100/0/threaded
http://www.securityfocus.com/bid/35480
http://www.securitytracker.com/id?1022457
http://www.vupen.com/english/advisories/2009/1713

Get alerted when CVE-2009-1202 or the next vulnerability affects your stack