CVE-2011-2054 Cisco ASA Secondary Authentication Bypass Vulnerability

2011-11-0200:00:00

CWE-287

cisco

www.cve.org

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

49.7%

JSON

A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability.

CNA Affected

[
  {
    "product": "Cisco ASA",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "8.4(1)"
      }
    ]
  }
]