---
title: "Cisco ASA CVE-2014-2120: WebVPN Login XSS, in KEV 2024"
url: https://erroneo.us/security/briefs/cisco-asa-cve-2014-2120-webvpn-xss/
description: "A 2014 XSS in the Cisco ASA WebVPN login page joined CISA KEV in November 2024 after botnet scanning. Confirm ASAs run a supported, current release."
type: security-brief
section: "Security Digest"
date_published: 2014-03-18
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2014-2120"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco ASA CVE-2014-2120: WebVPN Login XSS, in KEV 2024

**Verdict: Check exposure.** A low-impact, user-assisted bug from 2014; the real signal is that botnets still probe ASA VPN portals, so make sure no ASA is on decade-old software, which would also carry far worse exploited flaws.

- **Who must act:** Owners of Cisco ASA appliances with WebVPN or AnyConnect portals enabled that still run 2014-era software or have not been upgraded in years.
- **Who can relax:** Teams whose ASAs run a currently supported release and follow Cisco's recent advisories; this bug does not compromise the firewall itself.
- **Affected:** Cisco ASA Software with the WebVPN login page enabled, before the fix for bug CSCun19025 (fixed releases are listed in Cisco's bug tool, not in the public advisory)
- **Fixed:** Releases containing the CSCun19025 fix; Cisco advises upgrading to a fixed release and offers no workaround
- **CVEs:** CVE-2014-2120
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run show version on every ASA and confirm it is on a currently supported release with recent security fixes.
2. Upgrade any ASA still on 2014-era 8.x or 9.0/9.1 software; there is no workaround for this bug.
3. Check that later exploited ASA bugs are also fixed, including CVE-2020-3259 and CVE-2025-20333/CVE-2025-20362.
4. Disable WebVPN on interfaces where nobody needs it, and restrict the VPN portal to expected regions or IP ranges where you can.
5. If ASA logs show Androxgh0st-style probing, check your other internet-facing services against the same campaign's CVE list.

### How to check if you are affected

- Review WAF, IDS or upstream proxy logs for requests to the ASA WebVPN login page that carry script tags or HTML in parameters; Cisco's advisory references Snort rules 40224 through 40231.
- Review VPN authentication logs for logins from unexpected locations or at odd times, which could follow stolen credentials.
- Ask users to report VPN login pages that looked altered or asked for unusual information.

## What happened

On March 18, 2014, Cisco disclosed CVE-2014-2120, a cross-site scripting (XSS) bug in the WebVPN login page of Cisco Adaptive Security Appliance (ASA) Software. The [Cisco advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120) says insufficient input validation of a parameter lets an unauthenticated, remote attacker run an XSS attack against a WebVPN user. The attacker must convince the user to open a malicious link. Cisco rated it Medium (CVSS 2.0 4.3) and credited Piotr Karolak of Trustwave SpiderLabs. The bug is tracked as CSCun19025.

The bug sat quietly for a decade. On November 6, 2024, [CloudSEK](https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave) reported that the Androxgh0st botnet, which it says now also spreads Mozi payloads, was exploiting a long list of flaws in internet-facing systems. CVE-2014-2120 was on the list, with screenshots of exploitation attempts. On November 12, CISA [added five CVEs](https://www.cisa.gov/news-events/alerts/2024/11/12/cisa-adds-five-known-exploited-vulnerabilities-catalog) to KEV. Three of them were on CloudSEK's list: this one, Atlassian Jira CVE-2021-26086 and Metabase CVE-2021-41277. CISA did not state its evidence, but the overlap points to that campaign.

On December 2, 2024, Cisco updated the advisory: "In November 2024, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild." [The Hacker News](https://thehackernews.com/2024/12/cisco-warns-of-exploitation-of-decade.html) tied the update to CloudSEK's findings.

## Who is affected

ASA devices running software without the CSCun19025 fix, with the WebVPN login page enabled. The public advisory does not list fixed releases. It tells customers to get them through normal support channels and says no workaround exists. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2014-2120) gives no version range either. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-2120) scores it CVSS 3.1 6.1. CISA's own scoring is 5.4.

## Do you really need to act?

For this bug alone, rarely. It needs a user to click a crafted link, and it attacks the user's browser session on the VPN portal, not the firewall. Cisco's wording is "attempted" exploitation, and no public report describes a successful intrusion through it. Opportunistic botnets also try every old CVE on their list against anything that answers.

The useful question is what the listing reveals. An ASA still open to a 2014 bug has missed a decade of fixes. That includes later exploited ASA flaws in KEV, such as CVE-2020-3259, which CISA marks as used by ransomware, and CVE-2025-20333 and CVE-2025-20362, added in September 2025. So the verdict is check exposure. Confirm that no ASA is that far behind.

## What to do now

1. Run `show version` on each ASA and confirm it is on a currently supported release with recent security fixes.
2. Upgrade anything still on 2014-era 8.x or 9.0/9.1 code. Retire hardware that cannot run a supported release.
3. Check that later exploited ASA bugs are also fixed, not just this one.
4. Run `show running-config webvpn` and disable WebVPN on interfaces that do not need it.
5. If logs show this probing, check your Jira, Metabase, Laravel and PHP hosts against the rest of CloudSEK's list.

## How to tell if you were hit

Successful XSS here does not leave a mark on the ASA. Look upstream instead. Search WAF, IDS or proxy logs for requests to the WebVPN login page that carry script tags or HTML in parameters. Cisco's advisory references Snort rules 40224 through 40231 for this bug. Review VPN logins for unusual source locations or times, and ask users to report a portal page that looked wrong.

## Timeline

- Mar 18, 2014 — Cisco publishes the advisory.
- Nov 6, 2024 — CloudSEK reports Androxgh0st exploiting the CVE.
- Nov 12, 2024 — CISA adds CVE-2014-2120 to KEV.
- Dec 2, 2024 — Cisco updates the advisory to note attempted exploitation.
- Dec 3, 2024 — Federal remediation deadline.

## Sources

1. [Cisco — Cisco Adaptive Security Appliance WebVPN Login Page Cross-Site Scripting Vulnerability (cisco-sa-CVE-2014-2120)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120)
2. [CVE record — CVE-2014-2120](https://www.cve.org/CVERecord?id=CVE-2014-2120)
3. [NVD — CVE-2014-2120](https://nvd.nist.gov/vuln/detail/CVE-2014-2120)
4. [CISA — Known Exploited Vulnerabilities: CVE-2014-2120](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120)
5. [CISA — CISA Adds Five Known Exploited Vulnerabilities to Catalog (Nov 12, 2024)](https://www.cisa.gov/news-events/alerts/2024/11/12/cisa-adds-five-known-exploited-vulnerabilities-catalog)
6. [CloudSEK — Mozi Resurfaces as Androxgh0st Botnet: Unraveling the Latest Exploitation Wave](https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave)
7. [The Hacker News — Cisco Warns of Exploitation of Decade-Old ASA WebVPN Vulnerability](https://thehackernews.com/2024/12/cisco-warns-of-exploitation-of-decade.html)

---
Source page: https://erroneo.us/security/briefs/cisco-asa-cve-2014-2120-webvpn-xss/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt