CVE-2014-0655

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to change the user-cache contents via a replay attack involving crafted RADIUS Change of Authorization (CoA) messages, aka Bug ID CSCuj45332.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/101838
http://secunia.com/advisories/56366
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0655Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32362Vendor Advisory
http://www.securityfocus.com/bid/64700Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029575Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90164
http://osvdb.org/101838
http://secunia.com/advisories/56366
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0655Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32362Vendor Advisory
http://www.securityfocus.com/bid/64700Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029575Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90164

Timeline

Published: Jan 8, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-06564.0Cisco Context Directory Agent (CDA) allows remote authenticated users to trigger the omission of certain user-interface data via crafted fie CVE-2014-06574.0The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions CVE-2014-06585.4Cisco 9900 Unified IP phones allow remote attackers to cause a denial of service (unregistration) via a crafted SIP header, aka Bug ID CSCul CVE-2014-065910.0The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, an CVE-2014-06607.1Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) CVE-2014-06618.3The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-CVE-2014-06627.1The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (proce CVE-2014-06634.3Cross-site scripting (XSS) vulnerability in the web framework in Cisco Secure Access Control System (ACS) allows remote attackers to inject CVE-2014-06646.8The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP c CVE-2014-06654.0The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, w CVE-2014-06664.3Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote att CVE-2014-06676.3The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote auth