Cisco Warns of Exploitation of Decade
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-2120 | Cross-Site Scripting in Cisco ASA WebVPN Login Page CVE-2014-2120 is a cross-site scripting (CWE-79) vulnerability in the WebVPN login page of the Cisco Adaptive Security Appliance (ASA). A remote, unauthenticated attacker can inject arbitrary web script or HTML through an unspecified parameter of that login page, which is then rendered by a victim's browser. Successful exploitation lets the attacker execute script in the user's browser context, enabling actions such as credential capture, session manipulation, or phishing within the trusted WebVPN page. Only organizations running Cisco ASA devices with the WebVPN (clientless SSL VPN) login page exposed are affected. Despite the flaw's 2014 disclosure, CISA added it to the Known Exploited Vulnerabilities catalog on 2024-11-12, indicating active exploitation, with no public proof-of-concept code identified. Do: Inventory ASA devices and determine whether the WebVPN/clientless SSL VPN login page is enabled and reachable by untrusted users. Upgrade to the fixed releases specified in Cisco's advisory, per the CISA KEV required action, or disable WebVPN if it is not needed. Where mitigations are unavailable, CISA directs organizations to discontinue use of the affected product, so prioritize this for internet-facing VPN endpoints. | — | 19% | KEV |
| largeon the order of 100,000+ internet-exposed Cisco ASA/VPN gateways (subset with WebVPN enabled) |
Full article266 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 03, 2024Vulnerability / Network Security
Cisco on Monday updated an advisory to warn customers of active exploitation of a decade-old security flaw impacting its Adaptive Security Appliance (ASA).
The vulnerability, tracked as CVE-2014-2120 (CVSS score: 4.3), concerns a case of insufficient input validation in ASA's WebVPN login page that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a targeted user of the appliance.
"An attacker could exploit this vulnerability by convincing a user to access a malicious link," Cisco noted in an alert released in March 2014.
As of December 2, 2024, the networking equipment major has revised its bulletin to note that it has become aware of "additional attempted exploitation" of the vulnerability in the wild.
The development comes shortly after cybersecurity firm CloudSEK revealed that the threat actors behind AndroxGh0st are leveraging an extensive list of security vulnerabilities in various internet-facing applications, including CVE-2014-2120, to propagate the malware.
The malicious activity is also notable for the integration of the Mozi botnet, which allows AndroxGh0st to further expand in size and scope.
As a result, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog last month, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate it by December 3, 2024.
Users of Cisco ASA are highly recommended to keep their installations up-to-date for optimal protection and to safeguard against potential cyber threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/12/cisco-warns-of-exploitation-of-decade.html