Strix
26.1K

CVE-2020-3259

HIGHCVSS 7.5/10Actively ExploitedEPSS 71.79%

Last modified

CVE-2020-3259 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. CISA has confirmed active exploitation in the wild. EPSS estimates a 71.79% chance of exploitation in the next 30 days.

Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
71.79%

99.3th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoFirepower Threat Defense>= 6.2.3, < 6.2.3.16
CiscoFirepower Threat Defense>= 6.3.0, < 6.3.0.6
CiscoFirepower Threat Defense>= 6.4.0, < 6.4.0.9
CiscoFirepower Threat Defense>= 6.5.0, < 6.5.0.5
CiscoAdaptive Security Appliance Software>= 9.8, < 9.8.4.20
CiscoAdaptive Security Appliance Software>= 9.9, < 9.9.2.67
CiscoAdaptive Security Appliance Software>= 9.10, < 9.10.1.40
CiscoAdaptive Security Appliance Software>= 9.12, < 9.12.3.9
CiscoAdaptive Security Appliance Software>= 9.13, < 9.13.1.10

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2020-3259?
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
How severe is CVE-2020-3259?
CVE-2020-3259 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 71.79% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2020-3259?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-3259?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST