known ransomware use

Cisco ASA and FTD Information Disclosure Vulnerability

Added to KEV
2024-02-15
Federal due date
2024-03-07
Vendor
Cisco
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
EPSS
98.7th percentile (score 0.697, as of 2026-06-08)
NVD CVSS v3.1
Ransomware use
Known
Upstream
https://nvd.nist.gov/vuln/detail/CVE-2020-3259

CISA short description

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS percentile is the FIRST.org exploit-probability ranking as of the date noted above; it moves daily. CVSS reflects NVD's analysis at time of publication.