SQL Injection in Cisco Asa

CVE-2014-3382

The SQL*Net inspection engine in Cisco ASA Software 7.2 before 7.2(5.13), 8.2 before 8.2(5.50), 8.3 before 8.3(2.42), 8.4 before 8.4(7.15), 8.5 before 8.5(1.21), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.5), and 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted SQL REDIRECT packets, aka Bug ID CSCum46027.

Vulnerability class: SQL Injection

EPSS: 0.014 (69.3th percentile) — read the EPSS interpretation.

Affected products

  • Cisco Asa — versions 7.2.5, 7.2.5.10, 8.2.5
  • N/a — versions n/a

Weakness classification (CWE)

References