Secuno
ENNL
Book demo

CVE-2020-3259

Cisco ASA and FTD Information Disclosure

7.5 HIGHActively exploited (CISA KEV)Used in ransomwareEPSS 71.8%
  1. Published6 May 2020
  2. Added to CISA KEV15 Feb 2024
  3. Remediation due7 Mar 2024
Actively exploited (CISA KEV)

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.

Added to KEV: 15 Feb 2024Federal remediation due: 7 Mar 2024Used in ransomware

Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Cisco Secure Firewall Threat Defense≥ 6.2.3 < 6.2.3.16 · ≥ 6.3.0 < 6.3.0.6 · ≥ 6.4.0 < 6.4.0.9 · ≥ 6.5.0 < 6.5.0.5
Cisco Adaptive Security Appliance Software≥ 9.10 < 9.10.1.40 · ≥ 9.12 < 9.12.3.9 · ≥ 9.13 < 9.13.1.10 · ≥ 9.8 < 9.8.4.20

Remediation

Fixed in
Cisco Secure Firewall Threat Defense≥ 6.2.3.16
Cisco Adaptive Security Appliance Software≥ 9.10.1.40

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-938928.1
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated…
CVE-2026-821039.6
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker…
CVE-2026-1078118.8
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0,…
CVE-2026-839438.7
Exposure of sensitive information to an unauthorized actor in Azure API Center allows…
CVE-2026-1065019.6
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1,…
CVE-2026-1064598.5
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8,…

Frequently asked

Is CVE-2020-3259 being actively exploited?

Yes. CVE-2020-3259 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 15 Feb 2024. It has been used in ransomware campaigns.

How severe is CVE-2020-3259?

CVE-2020-3259 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 71.8% probability of exploitation.

Which products are affected by CVE-2020-3259?

Affected products include Cisco Secure Firewall Threat Defense, Cisco Adaptive Security Appliance Software.

How do I fix CVE-2020-3259?

Upgrade affected software to a fixed version, for example Cisco Secure Firewall Threat Defense 6.2.3.16, Cisco Adaptive Security Appliance Software 9.10.1.40 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-3259 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.