CVE-2020-3580(cisco / adaptive_security_appliance_software)

LOWCVSS 6.1 · MEDIUMCISA KEV

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

cisco CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-05-03. Apply updates per vendor instructions.

Patch / fix

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3580

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

adaptive_security_appliance_software
secure_firewall_threat_defense

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Affected systems

Vendors

cisco

Products

adaptive_security_appliance_softwaresecure_firewall_threat_defense

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

General Intels Daily@intels_daily1d
🔴 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 · 𝗔𝗰𝗰𝗲𝘀𝘀 𝘀𝗮𝗹𝗲 🏢 Target: 𝗡𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗺𝗲𝗻𝘁 𝗖𝗲𝗻𝘁𝗲𝗿 🧩 Products: 𝗖𝗶𝘀𝗰𝗼 𝗜𝗢𝗦 𝗫𝗘, 𝗖𝗶𝘀𝗰𝗼 𝗖𝗮𝘁𝗮𝗹𝘆𝘀𝘁 𝟵𝟰𝟬𝟳, 𝗖𝗶𝘀𝗰𝗼 𝗖𝗮𝘁𝗮𝗹𝘆𝘀𝘁 𝟵𝟯𝟬𝟬 🛡️ CVE-2016-6366, CVE-2020-3580 Threat actor Blacknet00 claims to have compromised the National Industrial Development Center (NIDC) in Saudi Arabia. The post provides detailed technical artifacts, including network device configurations, internal IP addresses, routing tables, and multiple backdoor credentials for a Cisco router (NIDC-DC-RTR-MOBILY). #AccessSale #InitialAccess #ThreatIntel #CTI
00010163
659 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	cisco	adaptive_security_appliance_software	-	-	-
App	cisco	secure_firewall_threat_defense	-	-	-

Explore more

Back to dashboard cisco CVEs adaptive_security_appliance_software vulnerabilities