CVE-2013-1194 Information disclosure in n/a
Remote attackers can enumerate valid VPN groups on Cisco ASA devices by analyzing response differences to IKE aggressive-mode messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-1194?
CVE-2013-1194 is a medium-severity vulnerability in Cisco Adaptive Security Appliance, published on 18 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ISAKMP implementation on Cisco Adaptive Security Appliances (ASA) devices generates different responses for IKE aggressive-mode messages depending on whether invalid VPN groups are specified, which allows remote attackers to enumerate groups via a series of messages, aka Bug ID CSCue73708.
Weakness: CWE-200
Which versions are affected by CVE-2013-1194?
It affects 2 products.
Products include Cisco Adaptive Security Appliance, Cisco Adaptive Security Appliance Software.
How do I fix CVE-2013-1194?
No fix has been published for CVE-2013-1194 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-1194 being exploited?
There is no known exploitation of CVE-2013-1194 in the wild and no public exploit code.
Other vulnerabilities in Cisco Adaptive Security Appliance
- CVE-2021-1573 Denial of service in Cisco Adaptive Security Appliance Software
- CVE-2021-34793 Denial of service in Cisco Adaptive Security Appliance (ASA) Software
- CVE-2021-40117 Denial of service in Cisco Adaptive Security Appliance (ASA) Software
- CVE-2021-40118 Denial of service in Cisco Adaptive Security Appliance (ASA) Software
- CVE-2020-3304 Denial of service in Cisco Adaptive Security Appliance (ASA) Software
Sources
Also known as GHSA-2p73-3mwf-5gr7.