CVE-2009-3457
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote...
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
Exploit likelihood
What each source reports
NVD Score used
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
- Record
CVE-2009-3457- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
- Record
CVE-2009-3457- Updated
- 2026-11-02
EUVDEUVD-2009-3439 No score
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
- Record
EUVD-2009-3439- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2v43-c695-wqxw No score
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote...
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
- Record
GHSA-2v43-c695-wqxw- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Cisco ACE XML Gateway 6.0 - Internal IP Disclosure | 2009-09-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3457 is a medium vulnerability (CVSS 5.0) in Cisco Ace Web Application Firewall, published September 29, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.19%, the 90th percentile. No source names a fixed version.
References
brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt
cisco.com/en/US/products/products_security_response09186a0080af8965.html
seclists.org/fulldisclosure/2009/Sep/0369.html
vupen.com/english/advisories/2009/2778
exchange.xforce.ibmcloud.com/vulnerabilities/53482
securityfocus.com/archive/1/506716/100/0/threaded