CVE-2020-3580
Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2020-3580 is a MEDIUM cross-site scripting (XSS) vulnerability affecting Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software, carrying a CVSS 3.1 score of 6.1. The web services interface of affected devices contains insufficient input validation that allows an unauthenticated, remote attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information by persuading a user to click a crafted link. Affected products include Cisco ASA Software (multiple version ranges) and Cisco FTD Software (multiple version ranges). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.91814 (99.69th percentile) confirms high real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | secure firewall threat defense | < 6.4.0.12; >= 6.5.0, < 6.6.4; >= 6.7.0, < 6.7.0.2 |
| cisco | adaptive security appliance software | < 9.8.4.34; >= 9.9, < 9.9.2.85; >= 9.10, < 9.12.4.13; >= 9.13, < 9.13.1.21; >= 9.14, < 9.14.2.8; >= 9.15, < 9.15.1.15 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3580(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-3580 is classified under CWE-79 — Cross-site Scripting (XSS). Cross-site Scripting occurs when a web application includes untrusted data in its output without proper validation, encoding, or escaping, allowing an attacker to execute malicious scripts in the context of another user's browser session. XSS vulnerabilities can lead to session hijacking, credential theft, defacement, and delivery of malware to end users.
In the context of Cisco ASA and FTD web services interfaces, this weakness is particularly concerning because these devices serve as critical network security infrastructure. Successful XSS exploitation against administrators of these devices could enable an attacker to steal session tokens, modify firewall configurations, or gain insight into network topology and VPN access controls. The vulnerability affects AnyConnect and WebVPN configurations specifically.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation
Impact Analysis
CVE-2020-3580 carries a CVSS 3.1 score of 6.1 (MEDIUM) with Changed Scope.
Confidentiality (LOW): Successful exploitation allows limited access to sensitive browser-based information, including session cookies, authentication tokens, and data displayed in the web services interface.
Integrity (LOW): Attackers can inject and execute arbitrary scripts in the context of the affected web services interface, potentially modifying displayed content or performing unauthorized actions on behalf of the victim.
Availability (NONE): The vulnerability does not directly impact system availability.
Scope Changed: The scope is Changed (C), meaning the vulnerability in the web services interface can impact resources beyond the vulnerable component, specifically the user's browser and associated session data.
Despite the MEDIUM CVSS rating, the EPSS score of 0.91814 (99.69th percentile) and KEV listing indicate this vulnerability is heavily targeted in real-world attacks, likely due to the high value of Cisco ASA/FTD administrative sessions.
Exploit Maturity
CVE-2020-3580 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability is actively exploited with proof-of-concept code publicly available. Security researchers have demonstrated exploitation through crafted URLs that trigger script execution when clicked by authenticated users of the ASA/FTD web interface.
Ransomware association: CVE-2020-3580 is associated with ransomware campaigns according to KEV data. XSS vulnerabilities on network security appliances provide a pathway to administrative access, which can then be leveraged for broader network compromise and ransomware deployment.
Attack surface: The attack requires user interaction — a victim must click a malicious link. However, targeted phishing campaigns against network administrators are a proven and effective attack vector. Organizations with internet-facing ASA/FTD web services interfaces have an elevated risk.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. The confirmed ransomware association elevates the urgency for all organizations.
Remediation
- Apply Cisco security patches immediately. Update Cisco ASA and FTD Software to fixed versions as specified in Cisco Security Advisory cisco-sa-asaftd-xss-multiple-FCB3vPZe.
- Identify affected device configurations. Verify which ASA and FTD devices are configured with AnyConnect or WebVPN features, as only these configurations are affected.
- Restrict access to web services interfaces. Limit access to ASA/FTD management and web services interfaces to trusted internal networks. Do not expose these interfaces directly to the internet.
- Implement security awareness for administrators. Educate network administrators about the risk of clicking links from untrusted sources, particularly those targeting ASA/FTD management interfaces.
- Deploy web application firewall rules. If available, implement WAF rules to detect and block XSS payloads targeting the ASA/FTD web services interface.
- Monitor for suspicious activity. Review access logs for the web services interface to detect unusual access patterns or exploitation attempts. Enable enhanced logging on affected devices.
- Validate session security. Review and rotate administrative session tokens and credentials for affected devices, particularly if exploitation may have occurred prior to patching.
Technical Details
CVE-2020-3580 is a MEDIUM-severity vulnerability in Cisco ASA and FTD Software that can be exploited remotely over the network. The attack complexity is low, but user interaction is required — the victim must click a crafted link. No prior authentication or privileges are needed to craft the exploit, though the impact depends on the victim's session privileges.
Technical mechanism: The web services interface of affected Cisco ASA and FTD devices does not properly validate user-supplied input before including it in HTTP responses. This allows an attacker to construct URLs containing malicious JavaScript that, when clicked by an authenticated user, executes in the context of the web services interface. The attacker can then access session cookies, authentication tokens, and other browser-stored data.
Affected configurations: The vulnerability affects only specific AnyConnect and WebVPN configurations. Devices without these features enabled are not vulnerable.
Attack scenario: An attacker crafts a URL containing XSS payload targeting the ASA/FTD web interface. Through phishing or social engineering, the attacker persuades a network administrator to click the link. The malicious script executes in the administrator's browser session, potentially stealing the session token or performing administrative actions.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects a network-accessible attack with low complexity, no privileges required, user interaction required, Changed scope, and low confidentiality/integrity impact with no availability impact.
Frequently Asked Questions
Is CVE-2020-3580 being actively exploited?
Yes, CVE-2020-3580 is actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a confirmed ransomware association. The EPSS score of 0.91814 (99.69th percentile) confirms very high exploitation activity in real-world attacks.
What products are affected by CVE-2020-3580?
Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software are affected across multiple version ranges, but only when configured with AnyConnect or WebVPN features. Consult Cisco Security Advisory cisco-sa-asaftd-xss-multiple-FCB3vPZe for specific version details.
How do I fix CVE-2020-3580?
Apply the security patches from Cisco as described in advisory cisco-sa-asaftd-xss-multiple-FCB3vPZe. Additionally, restrict access to web services interfaces to trusted networks, educate administrators about phishing risks, and monitor for suspicious activity on affected devices.
How severe is CVE-2020-3580?
CVE-2020-3580 is rated MEDIUM with a CVSS 3.1 score of 6.1. However, its KEV listing, confirmed ransomware association, and EPSS score of 0.91814 (99.69th percentile) indicate it is significantly more dangerous in practice than the CVSS score alone suggests. XSS on network security appliances can enable administrative session hijacking with severe downstream consequences.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.