DaystoPatch

CiscoExploited incident

Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability

CVE-2014-2120Medium, CVSS 4.3In CISA's Known Exploited Vulnerabilities catalog since 12 Nov 2024

  • Exploited after a fix existed
FixedA fix existed when the bug went public. No evidence yet of when every version was fixed.

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
not dated
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco Security Notice cisco-sa-CVE-2014-2120CuratedQuote verified

    A vulnerability in the WebVPN login page of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of WebVPN on the Cisco ASA.

    Coordinated disclosure, 'First Published: 2014 March 18 16:00 GMT'. Exploitation acknowledged only in revision 1.1 (CSAF 2024-12-02T20:05:54+00:00): 'In November 2024, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.'

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:986808bee5bc2cd0…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    CVE.org record CVE-2014-2120ClaimedQuote verified19 Mar 2014, 01:00 UTC

    Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2fa2519234cec17f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2014-2120)ClaimedQuote verified12 Nov 2024

    Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

    Added to CISA's KEV catalog on 2024-11-12.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet3 Dec 2024, 10:58 UTC

    Cisco has updated an advisory for CVE-2014-2120 to warn customers that the vulnerability has been exploited in the wild.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco Security Notice cisco-sa-CVE-2014-2120CuratedQuote verified

    First Published: 2014 March 18 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:986808bee5bc2cd0…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    Cisco Security Notice cisco-sa-CVE-2014-2120CuratedQuote verified

    Customers who wish to upgrade to a software version that includes fixes for these issues should contact their normal support channels.

    Upper bound: fixed builds may have shipped earlier (or later). A 2014 Cisco Security Notice: no fixed-release list; the CVSS temporal vector includes RL:OF (official fix). The notice date is used as the fix date; fixed releases may have shipped around or after it.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:986808bee5bc2cd0…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Adaptive Security Appliance (ASA) Software (WebVPN)
How we built this timeline

Decade-old bug added to KEV on 12 Nov 2024. No Fixed for all versions moment: the notice lists no fixed releases or trains.

Status 'patched' reflects that an official fix exists (RL:OF) and current ASA releases are not described as affected; the 2014-era ASA trains are long out of support. Severity follows the CVSS v2 base score 4.3.

Reported by Piotr Karolak (Trustwave SpiderLabs).

Related

No related incidents.

Cisco report card