Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability
Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
The flaw is cross-site scripting in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software, caused by insufficient validation of user-supplied input, and it affects only specific AnyConnect and WebVPN configurations. An unauthenticated remote attacker can exploit it by persuading a user of the interface to click a crafted link, which could let them run arbitrary script in the context of the interface or access sensitive browser-based information.
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 12 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 8 months after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+8 mo
- First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVknown ransomware use; EU database agrees+12 mo
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
3 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 3ExecutionTA0002
CVE-2020-3580 is a vulnerability affecting the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link to to execute arbitrary script code within the interface or access sensitive browser-based information.
DiscoveryTA0007
Detection
0 rules for this CVE · 103 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2020-3580 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Malicious LinkT1204.0014 general rules
- Symlink Etc Passwdhightest
- Potential ClickFix Execution Pattern - Registryhighexperimental
- Suspicious ClickFix/FileFix Execution Patternhighexperimental
- Suspicious Execution via macOS Script Editormediumtest
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Browser Information DiscoveryT12174 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX