Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-03-07. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
NØX Echo Lineage Signal: CVE-2020-3259 Entity: Cisco — Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco — Adaptive Security Appliance and Firepower Threat Defense | Veeam — Backup & Replication Lineage: Public vulnerability
NØØT Ransomware Watch Classification: Critical CVE: CVE-2020-3259 Product: Cisco — Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco — Adaptive Security Appliance and Firepower Threat Defense | Veeam — Backup & Replication Summary: CISA confirms active exploitation of CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766 through its KEV catalog. Affected products include: Cisco — Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), Cisco — Adaptive Security Appliance and Firepower Threat Defense. CISA also records known ransomware campaign use. Evidence: Active exploitation confirmed by CISA KEV; Ransomware activity; active exploitation; compromise; intrusion; IoCs Impact: CISA confirms active exploitation of CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766 through its KEV catalog. Affected products include: Cisco — Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), Cisco — Adaptive Security Appliance and Firepower Threat Defense. CISA also records known ransomware campaign use. Action: Apply CISA and vendor remediation guidance to affected systems immediately and identify exposed assets. Date: 20 October 2026 Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #Cisco_Adaptive_Security_Appliance_ASA_and_Firepowe #CVE_2020_3259 #ActiveExploitation #Exploit #Ransomware #CISAKEV
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | cisco | adaptive_security_appliance_software | - | - | - |
| App | cisco | secure_firewall_threat_defense | - | - | - |