Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2020-3259

HighExploitedPublic exploit

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the…

Published May 6, 2020 · Updated Aug 12, 2026

Key Facts

Patch immediately
  • CVE-2020-3259 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Firepower Threat Defense (Cisco), Secure Firewall Threat Defense (Cisco), Adaptive Security Appliance Software (Cisco) and 1 more product.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 29, 2024 and is known to be used in ransomware campaigns. Public exploit code is available.
  • EPSS estimates a 72% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Adaptive Security Appliance Software 9.10.1.40, Adaptive Security Appliance Software 9.12.3.9, Adaptive Security Appliance Software 9.13.1.10.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

72%

Higher than 99.4% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2020-3259 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVFeb 15, 2024Mar 7, 2024Known
Industry KEV feedJan 29, 2024Mar 7, 2024Known
CIRCL KEVFeb 15, 2024Mar 7, 2024Known
ENISA EUVDFeb 15, 2024n/aNot reported

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Products

4 affected entries in total
ProductAffected versionsFixed in
Firepower Threat DefenseCiscoSee advisory6.2.3.16
Secure Firewall Threat DefenseCiscoSee advisory6.2.3.16
Adaptive Security Appliance SoftwareCiscoSee advisory9.8.4.20
Cisco Adaptive Security Appliance (ASA) Software>= n/an/a

Patched Releases

Adaptive Security Appliance Software

9.10.1.40, 9.12.3.9, 9.13.1.10, 9.8.4.20, 9.9.2.67

Firepower Threat Defense

6.2.3.16

Secure Firewall Threat Defense

6.2.3.16, 6.3.0.6, 6.4.0.9, 6.5.0.5

Timeline

  1. Publicly disclosed

    May 6, 2020

  2. Added to Industry KEV feed

    Jan 29, 2024

  3. Added to CISA KEV

    Feb 15, 2024

  4. Added to CIRCL KEV

    Feb 15, 2024

  5. Added to ENISA EUVD

    Feb 15, 2024

  6. Last updated

    Aug 12, 2026

Weakness Type

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

7 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2020-3259 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo