CVE-2011-2054: cisco asa_5500_firmware Improper Authentication

Vulnerability summary

CVE-2011-2054 is a high (CVSS 7.5) Improper Authentication vulnerability in cisco asa_5500_firmware. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.7% of scored vulnerabilities.

Timeline

1. 19-02-2020
   PublishedVulnerability first disclosed.
2. 15-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.