Risk Letters

Exploited vulnerability

CVE-2020-3259

TLP:CLEAR

Cisco ASA and FTD Information Disclosure Vulnerability

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.

Facts

  • Vendor: Cisco
  • Product: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
  • CVSS: 7.5
  • EPSS (probability of exploitation within 30 days): 71.5 %
  • On CISA's Known Exploited Vulnerabilities list since: 15 February 2024
  • First known exploitation: 15 February 2024
  • Used in ransomware campaigns (per CISA): Yes
  • CISA's deadline for US federal agencies: 7 March 2024
  • Weakness: CWE-200
  • First seen by Risk Letters: 15 February 2024

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD