Unscored severity · published May 20, 2014
CVE-2014-2195
Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, does not properly handle group names,…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asyncos · Cisco
All versions, or not specified · source: NVD
CS
Content Security Management Appliance · Cisco
All versions, or not specified · source: NVD
ES
Email Security Appliance Firmware · Cisco
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2195
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2195
Third Party Advisory
http://www.securitytracker.com/id/1030258
More from Asyncos
10.0
CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
9.8
CVE-2026-76519
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
9.8
CVE-2026-76461
Cisco Secure Email Gateway SQL Injection Vulnerability
8.8
CVE-2022-20871
A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an…
8.8
CVE-2022-20868
A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an…