Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

MEDIUM 6.1EXPLOITED (CISA KEV)CVE-2014-2120 · Published 19/03/2014 · updated 17/06/2026

Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 12/11/2024. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
Adaptive Security Appliance (ASA) Cisco	Versions not published yet (product named by CISA KEV)

Description

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

References

tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120 · Broken Link
securityfocus.com/bid/66290 · Broken Link
securitytracker.com/id/1029935 · Broken Link
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2014-2120

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free