CVE-2020-3259: in the CISA KEV catalogue

Cisco ASA and FTD Information Disclosure Vulnerability. CISA added CVE-2020-3259 to the Known Exploited Vulnerabilities catalogue on 2024-02-15 with a default due date of 2024-03-07. Known ransomware campaign use: Known. Forensic triage flag: No.

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. (CISA description)

Vendor / product

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)

CWE

CWE-200

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS

72%, percentile 99 (scored 2026-11-03)

EPSS puts about 72 in 100 odds (72%) on exploitation activity being observed in the next 30 days. Its score is higher than or equal to that of 99% of scored CVEs. This is a model estimate about exploitation anywhere, not about your environment.

Your own deadline under CISA BOD 26-04 depends on exposure, automatability and technical impact: work it out with the BOD 26-04 calculator.