CVE-2009-3457
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote...
CVE-2009-3457 is a medium vulnerability (CVSS 5.0) in Cisco Ace Web Application Firewall, published September 29, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.19%, the 91st percentile. No source names a fixed version.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 4.19%EPSS, 91st percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Cisco ACE XML Gateway 6.0 - Internal IP Disclosure | 2009-09-25 |
What each source reports
NVD Score used
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
- Record
CVE-2009-3457- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
- Record
CVE-2009-3457- Updated
- 2026-11-02
EUVDEUVD-2009-3439No score
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
- Record
EUVD-2009-3439- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2v43-c695-wqxwNo score
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote...
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
- Record
GHSA-2v43-c695-wqxw- Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt
cisco.com/en/US/products/products_security_response09186a0080af8965.html
seclists.org/fulldisclosure/2009/Sep/0369.html
vupen.com/english/advisories/2009/2778
exchange.xforce.ibmcloud.com/vulnerabilities/53482
securityfocus.com/archive/1/506716/100/0/threaded