Medium 5.4Known exploited (CISA KEV)Published Mar 19, 2014

CVE-2014-2120Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified…

Updated under an hour ago (2026-10-19 04:50 UTC)

Does this affect you?

It affects cisco adaptive_security_appliance_software. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 12, 2024; federal agencies had to remediate by Dec 3, 2024. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for cisco adaptive_security_appliance_software

Exploited in the last 30 days

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

CVSS: 5.4 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Added to CISA KEV Nov 12, 2024; federal remediation due Dec 3, 2024Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 22.56% (percentile 98)
Assigned by: cisco
NVD analysis: Analyzed
Record last updated: Oct 22, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

cisco adaptive_security_appliance_software cisco:adaptive_security_appliance_software	all versions	CISA ADP
cisco adaptive_security_appliance_software cisco:adaptive_security_appliance_software	all versions	NVD

References

http://www.securitytracker.com/id/1029935vdb-entry, x-refsource-sectrack, broken-link, third-party-advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120vendor-advisory, x-refsource-cisco, broken-link
http://www.securityfocus.com/bid/66290vdb-entry, x-refsource-bid, broken-link, third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.