UpHeron
All vulnerabilities

Servers and applications

CVE-2009-1203

WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 does not properly distinguish its own login screen from the login screens it produces for third-party (1) FTP and (2) CIFS servers, which makes it easier for remote attackers to trick a user into sending WebVPN credentials to an arbitrary server via a URL associated with that server, aka Bug ID…

Severity
Medium 6.0
Published
25 Jun 2009
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
3.8% in the next 30 daysHigher than 90% of CVEs. EPSS by FIRST, 12 Nov 2026
Attack
Over the network · Needs a login
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
AV:N/AC:M/Au:S/C:P/I:P/A:P
Sources
NVD

Description

WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 does not properly distinguish its own login screen from the login screens it produces for third-party (1) FTP and (2) CIFS servers, which makes it easier for remote attackers to trick a user into sending WebVPN credentials to an arbitrary server via a URL associated with that server, aka Bug ID CSCsy80709.

From NVD.

Affected software

SoftwareAffected versions
Cisco ASA and Firepower Threat DefenseServers and applications · cpe:a:cisco:adaptive_security_appliance
  • Version 8.0(4)
  • Version 8.1.2
  • Version 8.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2009-1203
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2009-1203