Cisco ASA and FTD Information Disclosure Vulnerability (CVE-2020-3259)
Severity: high · Patch status: unknown · Since 2024-02-15 · CVE-2020-3259
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. CISA added CVE-2020-3259 to its Known Exploited Vulnerabilities catalog on Feb 15, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Mar 7, 2024 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
