Vulnpedia
← All CVEs

CVE-2020-3259

HIGH 7.5 KNOWN EXPLOITED RANSOMWARE ALL-YEARS

Published 2020-05-06 · Last modified 2026-08-12 · cisco · NVD: Analyzed

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2024-02-15, linked to ransomware campaigns. Patch or mitigate now.

Exploitation likelihood

71.5%chance of exploitation in 30 days · 99th percentile

● In CISA KEV (2024-02-15)○ Catalogued PoC◆ SSVC: exploitation active, automatable yes

Impact if exploited

7.5CVSS 3.1 · HIGH · NVD

  • ConfidentialityHigh
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Cisco

Products Cisco Adaptive Security Appliance (Asa) Software Firepower Threat Defense Adaptive Security Appliance Software Secure Firewall Threat Defense Adaptive Security Appliance Software

Weakness (CWE)

  • CWE-200: Information exposure

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References and research data (JSON)

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

53 more source reports

Known Affected Software Configurations

VendorProductVersion range
CiscoSecure Firewall Threat Defense≥ 6.2.3 and < 6.2.3.16
CiscoSecure Firewall Threat Defense≥ 6.3.0 and < 6.3.0.6
CiscoSecure Firewall Threat Defense≥ 6.4.0 and < 6.4.0.9
CiscoSecure Firewall Threat Defense≥ 6.5.0 and < 6.5.0.5
CiscoAdaptive Security Appliance Software≥ 9.8 and < 9.8.4.20
CiscoAdaptive Security Appliance Software≥ 9.9 and < 9.9.2.67
CiscoAdaptive Security Appliance Software≥ 9.10 and < 9.10.1.40
CiscoAdaptive Security Appliance Software≥ 9.12 and < 9.12.3.9
CiscoAdaptive Security Appliance Software≥ 9.13 and < 9.13.1.10

All CVSS metrics

  • HIGH 7.5 v3.0 · CNA Primary
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • HIGH 7.5 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • HIGH 7.5 v3.0 · NVD Secondary
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • MEDIUM 5 v2.0 · NVD Primary
    AV:N/AC:L/Au:N/C:P/I:N/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS