Cisco has issued an updated advisory warning users about active exploitation of a 10-year-old vulnerability in its Adaptive Security Appliance (ASA). The flaw, tracked as CVE-2014-2120, affects the WebVPN login page and allows attackers to conduct cross-site scripting (XSS) attacks.
Vulnerability Overview: CVE-2014-2120
Key Details
- CVSS Score: 4.3 (Medium severity)
- Flaw Type: Insufficient input validation in WebVPN login pages.
- Exploitation Method: Attackers convince users to click malicious links, triggering XSS attacks.
Cisco originally addressed this issue in March 2014 but has now observed renewed exploitation attempts targeting vulnerable systems in the wild.
Recent Exploitation and Threat Actor Activity
AndroxGh0st and Mozi Botnet
The renewed interest in CVE-2014-2120 coincides with activity from the AndroxGh0st malware group, which utilizes a variety of vulnerabilities in internet-facing applications, including:
- CVE-2014-2120
- Other unpatched flaws across popular systems.
The group also integrates the Mozi botnet, enabling rapid expansion of malicious campaigns to:
- Launch Distributed Denial-of-Service (DDoS) attacks.
- Execute data theft and lateral movement operations.
U.S. CISA Actions
In response to these threats, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2014-2120 to its Known Exploited Vulnerabilities (KEV) Catalog in November 2024. Federal Civilian Executive Branch (FCEB) agencies must remediate this vulnerability by December 3, 2024.
Recommendations for Cisco ASA Users
1. Update Systems Immediately
Ensure all Cisco ASA appliances are running the latest software versions. Cisco has provided patches to address CVE-2014-2120.
2. Implement Strong Security Practices
- Restrict Internet-Facing Services: Limit access to the WebVPN interface.
- Monitor Traffic: Use network monitoring tools to detect unusual activity.
- Deploy XSS Protection: Harden applications against input validation flaws.
3. Be Vigilant Against Phishing Attacks
Educate users about recognizing and avoiding malicious links, a key method of exploitation.
Implications for Cybersecurity
This resurgence in the exploitation of older vulnerabilities demonstrates that legacy flaws remain valuable to threat actors when unpatched systems persist. The AndroxGh0st campaign highlights the importance of regular patching and robust security measures to defend against advanced threats.
Organizations using Cisco ASA should prioritize remediation to mitigate risks from CVE-2014-2120 and other known vulnerabilities
