CVE-2014-2120VulnerabilityPublished 11/12/2024Updated 10/24/2026

CVE-2014-2120: Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

Affects Cisco Adaptive Security Appliance (ASA)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/12/2024
KEV deadline: 12/03/2024
EPSS: 22.6% chance of exploitation in 30 days – higher than 97% of CVEs

What to do

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120 (opens in a new tab)
nvd.nist.gov/vuln/detail/CVE-2014-2120 (opens in a new tab)

Description

Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

Weaknesses

CWE-79Cross-Site Scripting (XSS) (opens in a new tab)

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120 (opens in a new tab)
nvd.nist.gov/vuln/detail/CVE-2014-2120 (opens in a new tab)
cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2014-2120 (opens in a new tab)

What to do

Description

Weaknesses

References

Related threats