CVE-2008-7257
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security...
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.
Exploit likelihood
What each source reports
NVD Score used
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.
- Record
CVE-2008-7257- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.
- Record
CVE-2008-7257- Updated
- 2026-11-02
EUVDEUVD-2008-7213 No score
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.
- Record
EUVD-2008-7213- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q234-9925-w6jp No score
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security...
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.
- Record
GHSA-q234-9925-w6jp- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Cisco Adaptive Security Response - HTTP Response Splitting | 2010-06-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-7257 is a medium vulnerability (CVSS 4.3) in Cisco Asa 5580, published June 29, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.6%, the 96th percentile. No source names a fixed version.
References
securityfocus.com/bid/41159
cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.html
securitytracker.com/id?1024155
exchange.xforce.ibmcloud.com/vulnerabilities/59850
secureworks.com/ctu/advisories/SWRX-2010-001
nvd.nist.gov/vuln/detail/CVE-2008-7257
github.com/advisories/GHSA-q234-9925-w6jp