UpHeron
All vulnerabilities

Servers and applications

CVE-2020-3259

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 15 Feb 2024.

Severity
High 7.5
Published
6 May 2020
Last changed
12 Aug 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.8.4.20, 9.9.2.67, 9.10.1.40, 9.12.3.9, 9.13.1.10
Sources
NVD

Affected software

SoftwareAffected versions
Cisco ASA and Firepower Threat DefenseServers and applications · cpe:o:cisco:adaptive_security_appliance_software
  • From 9.8 before 9.8.4.20
  • From 9.9 before 9.9.2.67
  • From 9.10 before 9.10.1.40
  • From 9.12 before 9.12.3.9
  • From 9.13 before 9.13.1.10

Known exploited

CISA name
Cisco ASA and FTD Information Disclosure Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
7 Mar 2024
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-3259
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-3259