CVE-2011-2054 is a vulnerability in Cisco Asa
Published on February 19, 2020
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability.
Vulnerability Analysis
CVE-2011-2054 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2011-2054 has been classified to as an authentification vulnerability or weakness.
Products Associated with CVE-2011-2054
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2011-2054 are published in Cisco Asa:
Affected Versions
Cisco ASA Version 8.4(1) is affected by CVE-2011-2054Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.