{"id":"CVE-2020-3259","published":"2020-05-06T17:15:12Z","modified":"2026-08-12T05:17:30Z","title":"Cisco ASA and FTD Information Disclosure Vulnerability","vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","tier":"core","eol":null,"description":{"text":"A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.","provenance":"source","from":"NVD"},"summary":{"text":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software contain a buffer tracking flaw in the web services interface that mishandles invalid URLs. An unauthenticated remote attacker who sends a crafted GET request to that interface can retrieve device memory contents, potentially exposing confidential information, but only on devices running specific AnyConnect and WebVPN configurations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:05:09Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.715,"percentile":0.99414,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-02-15","dueDate":"2024-03-07","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB; https://nvd.nist.gov/vuln/detail/CVE-2020-3259","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-01-29","exploitedFirstSeen":"2024-01-29","ransomware":true,"evidence":[{"url":"https://www.truesec.com/hub/blog/akira-ransomware-and-exploitation-of-cisco-anyconnect-vulnerability-cve-2020-3259","date":"2024-01-29"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-02-15"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a","date":"2024-04-18"},{"url":"https://thehackernews.com/2024/04/akira-ransomware-gang-extorts-42.html","date":"2024-04-19"},{"url":"https://www.fortiguard.com/outbreak-alert/akira-ransomware","date":"2024-04-23"},{"url":"https://cyberplace.social/@GossiTheDog/111848755813858062","date":"2024-04-24"},{"url":"https://stonefly.com/blog/akira-ransomware-how-it-works-and-how-to-stop-it/","date":"2024-06-05"},{"url":"https://labs.withsecure.com/publications/mass-exploitation-the-vulnerable-edge-of-enterprise-security","date":"2024-06-12"},{"url":"https://www.uptycs.com/blog/uptycs-quarterly-cyber-threat-bulletin-q2-2024","date":"2024-07-02"},{"url":"https://www.orangecyberdefense.com/fileadmin/general/pdf/Cy-Xplorer-2024.pdf","date":"2024-07-08"}],"evidenceTotal":66,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers","url":"https://otx.alienvault.com/pulse/6ad8700a0fe145230ba94c11","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB","tags":["Vendor Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3259","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote request to public web interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an unauthenticated, remote attacker to retrieve memory contents","start":148,"end":223}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Memory contents read from device exposes data","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could lead to the disclosure of confidential information","start":253,"end":309}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-24530","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24530","exploited":true,"exploitedSince":"2024-02-15","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2020-05-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3259","provenance":"source"},{"date":"2024-01-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.truesec.com/hub/blog/akira-ransomware-and-exploitation-of-cisco-anyconnect-vulnerability-cve-2020-3259","provenance":"source"},{"date":"2024-02-15","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-02-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24530","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1380},"priority":{"score":73.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1004 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9941"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}