CVEvulnerability

CVE-2011-2054

7.5 HIGH Published 2020-02-19 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2020-02-19
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-287

Description

A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability.

Affected configurations

• cisco asa 5500 firmware 8.4\(1\) • cisco asa 5510 firmware 8.4\(1\) • cisco asa 5512-x firmware 8.4\(1\) • cisco asa 5515-x firmware 8.4\(1\) • cisco asa 5520 firmware 8.4\(1\) • cisco asa 5525-x firmware 8.4\(1\) • cisco asa 5540 firmware 8.4\(1\) • cisco asa 5545-x firmware 8.4\(1\) • cisco asa 5550 firmware 8.4\(1\) • cisco asa 5555-x firmware 8.4\(1\) • cisco asa 5580 firmware 8.4\(1\) • cisco asa 5585-x firmware 8.4\(1\)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References