What is CVE-2014-3394?

CVE-2014-3394 is a vulnerability in Cisco Adaptive Security Appliance Software, classified under Improper Certificate Validation. Published 2014-10-10.

Is CVE-2014-3394 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Cisco Adaptive Security Appliance Software

CVE-2014-3394

The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun10916.

Vulnerability class: Improper Certificate Validation

EPSS: 0.010 (60.4th percentile) — read the EPSS interpretation.

Affected products

Cisco Adaptive_security_appliance_software — versions 8.2.0.45, 8.2.1, 8.2.1.1
Cisco Adaptive_security_virtual_appliance
Cisco Asa_1000v_cloud_firewall
Cisco Asa_5505
Cisco Asa_5512-x
Cisco Asa_5515-x
Cisco Asa_5525-x
Cisco Asa_5545-x
Cisco Asa_5555-x
Cisco Asa_5580

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2014-3394

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2014-3394?: CVE-2014-3394 is a vulnerability in Cisco Adaptive Security Appliance Software, classified under Improper Certificate Validation. Published 2014-10-10.
Is CVE-2014-3394 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.