CVE-2014-2120
Medium 6.1 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
Metrics
- CVSS 3.1
-
6.1 (MEDIUM)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 23% (percentile: 98) as of 1 November 2026
- CWE
- CWE-79
Affected products
cisco: adaptive security appliance software
References
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120 Broken LinkVendor Advisory
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120 Broken LinkVendor Advisory
- http://www.securityfocus.com/bid/66290 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1029935 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/66290 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1029935 Broken LinkThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014… US Government Resource