CVE-2009-3457: Cisco Ace Web Application Firewall

Medium severity, CVSS 5.0. EPSS: 4.2% chance of exploitation in the next 30 days.

Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.

Affected products

• Cisco Ace Web Application Firewall: up to and including 6.0\(3\); version 6.0(0) only; version 6.0(1) only; version 6.0(2) only
• Cisco Ace XML Gateway: up to and including 6.0\(3\); version 6.0(0) only; version 6.0(1) only; version 6.0(2) only

Published 2009-09-29. Last modified 2026-06-16.