CVE-2011-2054: Cisco ASA Secondary Authentication Bypass Vulnerability
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2011-2054?
CVE-2011-2054 is a vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct.
How can a remote attacker exploit CVE-2011-2054?
A remote attacker can exploit CVE-2011-2054 by attempting to authenticate using the Cisco AnyConnect VPN client with a blank password, while the Secondary Authentication type is LDAP and the primary credentials are correct.
What is the severity of CVE-2011-2054?
CVE-2011-2054 has a severity rating of high.
How can I protect myself from CVE-2011-2054?
To protect yourself from CVE-2011-2054, ensure that the Secondary Authentication type is not set to LDAP or use a strong password for the Cisco AnyConnect VPN client.
Where can I find more information about CVE-2011-2054?
You can find more information about CVE-2011-2054 at the following link: [https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884]