CVE-2011-2054

Published: Feb 19, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability.

Affected (12)

Products: Cisco: Asa 5500 Firmware, Asa 5510 Firmware, Asa 5512 X Firmware, Asa 5515 X Firmware, Asa 5520 Firmware, Asa 5525 X Firmware, Asa 5540 Firmware, Asa 5545 X Firmware, Asa 5550 Firmware, Asa 5555 X Firmware, Asa 5580 Firmware, Asa 5585 X Firmware

12 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5500 Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5500	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5510 Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5510	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5512 X Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5512 X	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5515 X Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5515 X	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5520 Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5520	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5525 X Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5525 X	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5540 Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5540	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5545 X Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5545 X	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5550 Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5550	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5555 X Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5555 X	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5580 Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5580	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Asa 5585 X Firmware	Version 8.4(1)

Running on/with	Platform Versions
Cisco Asa 5585 X	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884

Source: psirt@cisco.com

Vendor Advisory

https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.