$ cve CVE-2020-3259 JSON

CVE-2020-3259 KEV

7.5

HIGH · CVSS 3.1 · EPSS 71.8% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2024-03-07.

Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

Scoring

CVSS	7.5 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS	71.79% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-200
On CISA KEV	yes — remediate by 2024-03-07
Public exploit	none known
Published	2020-05-06
Last modified	2026-08-12

CISA KEV

Name	Cisco ASA and FTD Information Disclosure Vulnerability
Added	2024-02-15
Due	2024-03-07
Vendor / product	Cisco / Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Ransomware use	known

Affected (2)

Vendor	Product
cisco	adaptive security appliance software
cisco	secure firewall threat defense

References

→ the Explorer · watch your stack · NVD