CVE-2015-0677

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-04-13 · updated 2026-06-17
Weakness: CWE-20

Description

The XML parser in Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.28), 8.6 before 8.6(1.17), 9.0 before 9.0(4.33), 9.1 before 9.1(6), 9.2 before 9.2(3.4), and 9.3 before 9.3(3), when Clientless SSL VPN, AnyConnect SSL VPN, or AnyConnect IKEv2 VPN is used, allows remote attackers to cause a denial of service (VPN outage or device reload) via a crafted XML document, aka Bug ID CSCus95290.

Affected products

Cisco ASA Software: 8.4.1, 8.4.1.3, 8.4.1.11, 8.4.2, 8.4.2.1, 8.4.2.8 (+64)

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa
http://www.securitytracker.com/id/1032045
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa
http://www.securitytracker.com/id/1032045

Get alerted when CVE-2015-0677 or the next vulnerability affects your stack