CVE-2020-3580
MediumExploitedPublic exploitMultiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web…
Published Jun 29, 2021 · Updated Aug 11, 2026 · Also known as TR-21-0527
Key Facts
Patch immediately- CVE-2020-3580 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting Secure Firewall Threat Defense (Cisco), Adaptive Security Appliance Software (Cisco), Firepower Threat Defense (Cisco) and 1 more product.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 3, 2021 and is known to be used in ransomware campaigns. Public exploit code is available.
- EPSS estimates a 86% probability of exploitation in the next 30 days.
- Fixed versions are available, including Adaptive Security Appliance Software 9.12.4.13, Adaptive Security Appliance Software 9.13.1.21, Adaptive Security Appliance Software 9.14.2.8.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
86%
Higher than 99.7% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings, used by ransomware
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2020-3580 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Nov 3, 2021 | May 3, 2022 | Known |
| Industry KEV feed | Nov 3, 2021 | May 3, 2022 | Known |
| CIRCL KEV | Nov 3, 2021 | May 3, 2022 | Known |
| ENISA EUVD | Nov 3, 2021 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Secure Firewall Threat DefenseCisco | See advisory | 6.4.0.12 |
| Adaptive Security Appliance SoftwareCisco | See advisory | 9.8.4.34 |
| Firepower Threat DefenseCisco | See advisory | 6.4.0.12 |
| Cisco Adaptive Security Appliance (ASA) Software | >= n/a | n/a |
Patched Releases
Adaptive Security Appliance Software
9.12.4.13, 9.13.1.21, 9.14.2.8, 9.15.1.15, 9.8.4.34, 9.9.2.85
Firepower Threat Defense
6.4.0.12
Secure Firewall Threat Defense
6.4.0.12, 6.6.4, 6.7.0.2
Timeline
Publicly disclosed
Jun 29, 2021
Added to CISA KEV
Nov 3, 2021
Added to Industry KEV feed
Nov 3, 2021
Added to CIRCL KEV
Nov 3, 2021
Added to ENISA EUVD
Nov 3, 2021
Last updated
Aug 11, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- advisoryhttps://heimdalsecurity.com/blog/a-cisco-asa-vulnerability-is-actively-exploited/
- advisoryhttps://heimdalsecurity.com/blog/xss-attack-definition-types-prevention/
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2021-1134
- advisoryhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-1134
- advisoryhttps://www.bleepingcomputer.com/news/security/cisco-asa-vulnerability-actively-exploited-after-exploit-released/
FAQ
Common Questions.
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device.
Affected: Secure Firewall Threat Defense (Cisco); Adaptive Security Appliance Software (Cisco); Firepower Threat Defense (Cisco), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 3, 2021 and is known to be used in ransomware campaigns.
Yes. It was added on Nov 3, 2021 with a federal remediation due date of May 3, 2022.
Public exploit code is available.
Fixed versions are available, including Adaptive Security Appliance Software 9.12.4.13, Adaptive Security Appliance Software 9.13.1.21, Adaptive Security Appliance Software 9.14.2.8.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2020-3580 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo