CVE-2020-3259
Cisco ASA and FTD Information Disclosure Vulnerability
Description
CVE-2020-3259 is an information disclosure vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The vulnerability allows an unauthenticated remote attacker to send a specially crafted GET request to the web services interface, causing the device to return memory contents that may include confidential information such as credentials or session tokens. CVE-2020-3259 specifically affects deployments using AnyConnect or WebVPN configurations on the affected Cisco security appliances. CISA has confirmed active exploitation in the wild, and with a confirmed ransomware association and an EPSS score of 69.7% (98.6th percentile), this is a high-priority vulnerability for all organizations using Cisco ASA or FTD with the affected configurations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | secure firewall threat defense | >= 6.2.3, < 6.2.3.16; >= 6.3.0, < 6.3.0.6; >= 6.4.0, < 6.4.0.9; >= 6.5.0, < 6.5.0.5 |
| cisco | adaptive security appliance software | >= 9.8, < 9.8.4.20; >= 9.9, < 9.9.2.67; >= 9.10, < 9.10.1.40; >= 9.12, < 9.12.3.9; >= 9.13, < 9.13.1.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes a weakness in which software inadvertently exposes sensitive information to an actor that is not explicitly authorized to access it. In CVE-2020-3259, a buffer tracking issue in the Cisco ASA and FTD web services interface causes the software to include portions of device memory — potentially containing credentials, session data, or configuration details — in responses to malformed GET requests from unauthenticated attackers.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2020-3259 carries a CVSS 3.1 score of 7.5 (HIGH) and is remotely exploitable without any authentication or user interaction — any internet-facing Cisco ASA or FTD appliance with AnyConnect or WebVPN enabled is exposed. Confidentiality (High): An attacker can retrieve memory contents from the device, which may include session tokens, authentication credentials, or other sensitive configuration data that can be used for further attacks or lateral movement. Integrity and availability are not directly impacted by this vulnerability (both rated None in the CVSS vector), but the confidentiality breach can enable subsequent attacks that affect those dimensions. The EPSS score of 69.7% (98.6th percentile) reflects a very high likelihood of active exploitation, and CISA's KEV listing with a confirmed ransomware connection means attackers have been using memory contents extracted from these devices to facilitate ransomware campaigns.
Exploit Maturity
CVE-2020-3259 is confirmed by CISA as actively exploited in the wild and carries a ransomware association, indicating that threat actors have successfully leveraged the memory disclosure to support ransomware operations. The EPSS score of 69.7% (98.6th percentile) places this vulnerability among the most actively targeted in the current threat landscape. No exploit URLs tagged explicitly as "Exploit" are included in the provided references, but the combination of CISA KEV status, ransomware linkage, and high EPSS percentile is sufficient to confirm that functional exploits are in active use. Organizations running Cisco ASA or FTD with AnyConnect or WebVPN configurations should treat this as an active threat requiring immediate remediation.
Remediation
- Apply the Cisco security advisory patches for CVE-2020-3259 immediately. CISA's required action states: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." The full advisory is available at https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB.
- Upgrade Cisco ASA Software and Cisco FTD Software to a fixed version as specified in the Cisco security advisory. Prioritize appliances with AnyConnect SSL VPN or WebVPN configurations enabled, as these are the affected attack surfaces.
- If immediate patching is not possible, consider disabling the AnyConnect or WebVPN web services interface on externally accessible appliances as an interim mitigation, restricting VPN access to alternative methods.
- Audit memory and configuration for signs of prior exploitation: review authentication logs for unexpected access using credentials that may have been exposed, and check for unauthorized VPN sessions or configuration changes that could indicate prior reconnaissance using leaked memory data.
- Enforce network segmentation and access controls to limit exposure of the Cisco ASA/FTD management and VPN interfaces to only authorized network ranges, reducing the attack surface for internet-facing exploitation.
Technical Details
CVE-2020-3259 is caused by a buffer tracking issue in the web services interface of Cisco ASA Software and Cisco FTD Software when the software parses invalid or malformed URLs submitted to the web services interface. The flaw falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): when an attacker submits a crafted GET request to the web services interface, the buffer tracking logic fails to properly account for boundaries, causing the software to include unintended memory contents in the response. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the vulnerability is exploitable remotely with no authentication, no user interaction, and low complexity — making it accessible to any attacker who can reach the web services interface. The scope is unchanged (S:U), and only confidentiality is impacted, but the information disclosed — potentially including session tokens and credentials — can serve as a stepping stone for further, more destructive attacks.
Frequently Asked Questions
Is CVE-2020-3259 being actively exploited?
Yes. CISA has confirmed that CVE-2020-3259 is actively exploited in the wild and has listed it in the Known Exploited Vulnerabilities catalog. The vulnerability has a confirmed ransomware association, indicating that threat actors have leveraged exposed memory contents to facilitate ransomware campaigns. The EPSS score of 69.7% (98.6th percentile) further confirms very high exploitation activity.
What products are affected by CVE-2020-3259?
CVE-2020-3259 affects Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. Specifically, only deployments configured with AnyConnect SSL VPN or WebVPN features are vulnerable. Cisco provides version-specific fixed releases in its security advisory.
How do I fix CVE-2020-3259?
Apply the patches specified in Cisco's security advisory (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB) to upgrade affected Cisco ASA or FTD software to a non-vulnerable version. If immediate patching is not feasible, disable the AnyConnect or WebVPN web services interface on internet-facing appliances as an interim measure.
How severe is CVE-2020-3259?
CVE-2020-3259 is rated HIGH with a CVSS 3.1 score of 7.5, reflecting a high-impact confidentiality breach that is remotely exploitable without authentication or user interaction. The EPSS score of 69.7% (98.6th percentile) and confirmed ransomware linkage elevate the practical risk significantly above what the CVSS score alone suggests, making this a critical remediation priority for all affected Cisco ASA and FTD deployments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.