CVE-2014-2195 Privilege escalation in n/a
Remote attackers can gain elevated role privileges on Cisco ESA/SMA devices by exploiting group name handling flaws when Active Directory is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-2195?
CVE-2014-2195 is a medium-severity vulnerability in Cisco Asyncos, published on 20 May 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085.
Weakness: CWE-20
Which versions are affected by CVE-2014-2195?
It affects 3 products.
Products include Cisco Asyncos, Cisco Content Security Management Appliance, Cisco Email Security Appliance Firmware.
How do I fix CVE-2014-2195?
No fix has been published for CVE-2014-2195 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-2195 being exploited?
There is no known exploitation of CVE-2014-2195 in the wild and no public exploit code.
Other vulnerabilities in Cisco Asyncos
- CVE-2025-20393 Cisco Multiple Products Improper Input Validation
- CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal
- CVE-2026-76461 Cisco Secure Email Gateway SQL Injection
- CVE-2024-20435 Command injection in Cisco Secure Web Appliance
- CVE-2019-15956 Cisco Web Security Appliance Unauthorized Device Reset Vulnerability
Sources
Also known as GHSA-x8v4-j6fc-388p.