PT-2020-7100 · Cisco · Cisco Asa+1

Published 2020-02-19 · Updated 2024-06-15 · CVE-2011-2054

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco ASA (affected versions not specified)

Description A vulnerability exists in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. This issue is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-2054

OPENSUSE-SU-2024:10046-1

Affected Products

Cisco Asa

Cisco Anyconnect Vpn

References · 5

• https://osv.dev/vulnerability/openSUSE-SU-2024:10046-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2054 · Security Note
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884 · Vendor Advisory
• https://suse.com/security/cve/CVE-2011-2054 · Note
• https://t.me/cibsecurity/9914 · Telegram Post