CVE-2014-2120 kev in the critical feed json
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attacke…
published 2014-03-19 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-2160
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-11-12
- epss
- 22.6%
- EPSS 22.6% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Timeline
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 23 mo ago
- Patch by
- 2024-12-03 (23 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Cisco, Adaptive Security Appliance (ASA)
- CISA name
- Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 14 mo ago
Exploit prediction
22.56% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- cisco adaptive_security_appliance_software
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
tools.cisco.com
/security/center/content/CiscoSecurityNotice/CVE-2014-2120
vendor-advisory, broken-link
-
securitytracker.com
/id/1029935
vdb-entry, broken-link, third-party-advisory
-
securityfocus.com
/bid/66290
vdb-entry, broken-link, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120
government-resource, us-government-resource
Sources
- CVE List CVE-2014-2120
- NVD CVE-2014-2120
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.