What’s Vulnerable › Vulnerabilities

CVE-2014-2120: Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-11-12
• EPSS: 22.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-03-19 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

Affected products

• Cisco ASA Software: all versions

References

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120
• http://www.securityfocus.com/bid/66290
• http://www.securitytracker.com/id/1029935
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120
• http://www.securityfocus.com/bid/66290
• http://www.securitytracker.com/id/1029935
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120

Get alerted when CVE-2014-2120 or the next vulnerability affects your stack