Is CVE-2014-2120 being actively exploited?

Yes. CVE-2014-2120 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on November 12, 2024.

What is the CVSS score for CVE-2014-2120?

CVE-2014-2120 has a CVSS 3.1 base score of 6.1 (MEDIUM).

CVE-2014-2120

MEDIUM · CVSS 6.1CISA KEV: actively exploitedEPSS 22.6%EU EUVD: exploited

Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.

Key facts

CVSS score: 6.1 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
EPSS score: 22.6% (98th percentile)
In CISA KEV: Yes, added November 12, 2024
In EU EUVD: Yes (EUVD-2014-2160)
Published: March 19, 2014
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

Added to the KEV catalog on November 12, 2024; federal remediation due December 3, 2024.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2014-2160 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

cisco / adaptive security appliance software

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120(Broken Link, Vendor Advisory)
http://www.securityfocus.com/bid/66290(Broken Link, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1029935(Broken Link, Third Party Advisory, VDB Entry)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-2120(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain