CVE-2014-2120
Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2014-2120 is a medium-severity cross-site scripting (XSS) vulnerability in the WebVPN login page of Cisco Adaptive Security Appliance (ASA) Software. The vulnerability allows remote attackers to inject arbitrary web script or HTML through an unspecified parameter on the login page, potentially compromising user sessions and credentials. With a CVSS v3.1 base score of 6.1, the flaw requires user interaction (a victim must visit a crafted URL) but needs no authentication to exploit. Despite being disclosed in 2014, CISA has added CVE-2014-2120 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 3, 2024, and its EPSS score of 63.87% at the 98.4th percentile indicates significant ongoing exploitation activity a decade after its initial disclosure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive security appliance software | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120(Broken Link, Vendor Advisory)
- http://www.securityfocus.com/bid/66290(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1029935(Broken Link, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120(US Government Resource)
Weakness Type
Cross-Site Scripting (XSS) in WebVPN Login Page
CVE-2014-2120 is a reflected cross-site scripting (XSS) vulnerability in the Cisco ASA WebVPN login page. XSS vulnerabilities occur when an application includes user-supplied data in web page output without proper sanitization or encoding, allowing an attacker to inject malicious scripts that execute in the context of another user's browser session. In this case, the WebVPN login page accepts a parameter that is reflected back into the HTML response without adequate output encoding. An attacker can craft a malicious URL containing JavaScript code that, when clicked by a victim, executes in the victim's browser within the security context of the ASA WebVPN portal. This is classified as reflected XSS because the malicious payload is delivered through the URL and reflected in the immediate server response rather than being stored on the server.
Impact Analysis
The impact of CVE-2014-2120 affects both confidentiality and integrity at a low level, with the scope changed (S:C) indicating that the vulnerability in the ASA WebVPN portal can impact resources beyond the vulnerable component itself, specifically the victim's browser and session. Confidentiality is partially compromised because injected JavaScript can steal session cookies, capture keystrokes on the login page, read the contents of the WebVPN portal displayed to the victim, and exfiltrate this data to an attacker-controlled server. Since this targets the VPN login page, the most valuable target is the victim's VPN credentials.
Integrity is partially impacted because the injected script can modify the content of the login page as displayed to the victim. An attacker could alter the login form to redirect credentials to a malicious server, display fake error messages, inject additional form fields to harvest information, or redirect the user to a phishing page after apparent authentication.
Availability is not directly impacted (A:N). The changed scope (S:C) is significant because the vulnerability exists in the ASA's WebVPN component but impacts the victim's browser environment. The requirement for user interaction (UI:R) means the victim must click a crafted link, which moderates the exploitability. The EPSS score of 63.87% at the 98.4th percentile is remarkably high for a decade-old medium-severity XSS vulnerability, suggesting it remains a reliable target in active exploitation campaigns. The ransomware association is listed as unknown.
Exploit Maturity
CVE-2014-2120 demonstrates persistent exploit maturity, with confirmed active exploitation more than ten years after its initial disclosure in 2014. CISA's addition of this vulnerability to the Known Exploited Vulnerabilities catalog in late 2024 with a December 3, 2024 remediation deadline confirms that threat actors continue to actively exploit this flaw against unpatched Cisco ASA devices.
The EPSS score of 63.87% at the 98.4th percentile is exceptionally high for a 2014-era medium-severity XSS vulnerability, indicating sustained and widespread exploitation. The original Cisco security notice was published at tools.cisco.com (now a broken link), tracking the issue as Bug ID CSCun19025. The continued exploitation of this vulnerability reflects the large installed base of Cisco ASA devices, many of which run outdated software versions, and the strategic value of compromising VPN login pages where users enter corporate credentials. While the ransomware association is listed as unknown, compromised VPN credentials provide a direct path into corporate networks, making this vulnerability valuable for initial access in targeted attack campaigns.
Remediation
-
Upgrade Cisco ASA Software. Apply the latest Cisco ASA software version that addresses CVE-2014-2120. Since this vulnerability was disclosed in 2014, numerous software updates have been released. Consult Cisco's security advisory resources and the Cisco Software Checker tool to identify the appropriate upgrade path for your specific ASA hardware and software version.
-
Implement input validation and output encoding. If an immediate upgrade is not possible, work with Cisco TAC to identify available workarounds. Consider deploying a web application firewall or reverse proxy in front of the WebVPN portal that can sanitize reflected XSS payloads in URL parameters.
-
Restrict WebVPN portal exposure. Limit access to the ASA WebVPN login page to known IP ranges where possible. While VPN portals are inherently designed to be internet-facing, implementing geographic IP restrictions or requiring a pre-authentication step can reduce the attack surface.
-
Educate users about phishing via crafted URLs. Since this is a reflected XSS vulnerability requiring user interaction, security awareness training that teaches users to verify URLs before clicking, especially URLs containing unusual parameters pointing to the VPN login page, can serve as an additional layer of defense.
-
Monitor for exploitation attempts. Review ASA WebVPN access logs for requests containing script injection patterns in URL parameters. Implement alerting for any access attempts that include JavaScript or HTML tags in the login page URL parameters, as these are strong indicators of exploitation attempts.
Technical Details
CVE-2014-2120 is a reflected cross-site scripting vulnerability in the Cisco ASA WebVPN login page with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, resulting in a base score of 6.1 (Medium). The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no privileges (PR:N), but it does require user interaction (UI:R), meaning the victim must click a crafted URL.
The vulnerability exists in the WebVPN login page served by Cisco ASA devices. When a user accesses the WebVPN portal, the login page accepts certain parameters that are reflected into the HTML response without proper output encoding. An attacker can construct a URL to the legitimate ASA WebVPN login page that includes malicious JavaScript code in these parameters. When a victim clicks this URL, the ASA server reflects the malicious code back in the login page HTML, and the victim's browser executes it in the security context of the ASA WebVPN domain.
The changed scope (S:C) is critical to understanding this vulnerability's impact. The vulnerable component is the ASA WebVPN application, but the impacted component is the victim's web browser. The injected script executes with the same origin as the ASA WebVPN portal, giving it access to any cookies, session tokens, and page content associated with that origin. The confidentiality and integrity impacts are both low (C:L/I:L) because the attack is limited to what can be achieved through browser-side script execution rather than direct server compromise. Cisco tracked this issue as Bug ID CSCun19025. The vulnerability affects Cisco ASA Software versions that include the WebVPN feature, with the specific affected versions tied to the ASA software train available in 2014.
Frequently Asked Questions
What is CVE-2014-2120?
CVE-2014-2120 is a cross-site scripting (XSS) vulnerability in the WebVPN login page of Cisco Adaptive Security Appliance (ASA) Software. It allows attackers to inject malicious scripts through crafted URLs, which execute in the victim's browser when they visit the login page.
Why is a 2014 vulnerability still being actively exploited?
Many Cisco ASA devices run outdated firmware and are exposed to the internet as VPN gateways. The large installed base of unpatched devices, combined with the strategic value of compromising VPN login pages where users enter corporate credentials, makes this vulnerability persistently valuable to attackers.
How does this XSS attack work in practice?
An attacker crafts a URL pointing to the legitimate Cisco ASA WebVPN login page but includes malicious JavaScript in a URL parameter. The attacker distributes this URL via phishing emails or other social engineering. When a victim clicks the link, the login page reflects the malicious script, which can steal credentials, redirect the user, or modify the page content.
Does this vulnerability allow direct access to the ASA device?
No. CVE-2014-2120 is a client-side vulnerability that executes in the victim's browser, not on the ASA device itself. However, the injected script can steal VPN credentials entered on the login page, which can then be used to authenticate to the VPN and gain network access.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.