Cisco · Adaptive Security Appliance (ASA)
CVE-2014-2120
Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
What it is
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
CISA: Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: December 3, 2024
More exploited flaws from Cisco
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 24, 2022 | SNMP Buffer Overflow | Adaptive Security Appliance (ASA) | High 8.8 | 88% |
| May 24, 2022 | CLI Remote Code Execution | Adaptive Security Appliance (ASA) | High 7.8 | 23% |
| Nov 3, 2021 | Denial-of-Service | Adaptive Security Appliance (ASA) | High 7.5 | 99.9% |
| Oct 14, 2026 | Relative Path Traversal | Secure Email Gateway | Critical 9.8 | 2.2% |
| Sep 30, 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critical 9.8 | 39% |
| Sep 16, 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critical 10.0 | 76% |
| Sep 14, 2026 | SQL Injection | Secure Email Gateway | Critical 9.8 | 30% |
| Sep 9, 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Critical 10.0 | 88% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.