EXPOSURES › CVE-2020-3259
CVE-2020-3259
CRITICAL ⌖ ON CISA KEV · EXPLOITEDCisco ASA/FTD memory disclosure flaw leaked secrets via invalid URL parsing in specific AnyConnect/WebVPN setups.
An information disclosure vulnerability in Cisco ASA and FTD allowed attackers to retrieve memory contents by parsing invalid URLs, exposing confidential data. This affects specific AnyConnect and WebVPN configurations, meaning DIBs relying on these for secure remote access face direct data exposure risks. Organizations must verify patch levels and restrict AnyConnect/WebVPN usage to mitigate this known, actively exploited flaw.
Shame score — A known, actively exploited vulnerability in critical network security hardware that leaked confidential data through a preventable memory disclosure flaw.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |