Evidence dossier

CVE-2020-3259

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability

69.4–90.7Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

State: PUBLISHED
Published: May 6, 2020
Updated: Oct 21, 2025
Evidence coverage: 72%

CISA KEVCatalog member

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

FIRST EPSS71.79%

2026-07-18 · v2026.06.15 · percentile 99.4%

Source stateConflict visible

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

ciscooriginal assertion

container

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability

Jul 19, 2026Original evidence ↗

CVEderivative copy

container

CVE Program Container

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

Cisco ASA and FTD Information Disclosure Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.717890000000; percentile 0.993550000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

ciscoadaptive_security_appliance_software

[{"status": "affected", "version": "9.9", "lessThan": "9.9.2..67", "versionType": "custom"}]unknown

ciscoadaptive_security_appliance_software

[{"status": "affected", "version": "9.10", "lessThan": "9.10.1.40", "versionType": "custom"}]unknown

ciscoadaptive_security_appliance_software

[{"status": "affected", "version": "9.12", "lessThan": "9.12.3.9", "versionType": "custom"}]unknown

ciscoadaptive_security_appliance_software

[{"status": "affected", "version": "9.13", "lessThan": "9.13.1.10", "versionType": "custom"}]unknown

ciscoadaptive_security_appliance_software

[{"status": "affected", "version": "9.8", "lessThan": "9.8.4.20", "versionType": "custom"}]unknown

ciscofirepower_threat_defense

[{"status": "affected", "version": "6.2.3", "lessThan": "6.2.3.16", "versionType": "custom"}]unknown

ciscofirepower_threat_defense

[{"status": "affected", "version": "6.3.0", "lessThan": "6.3.0.6", "versionType": "custom"}]unknown

ciscofirepower_threat_defense

[{"status": "affected", "version": "6.4.0", "lessThan": "6.4.0.9", "versionType": "custom"}]unknown

ciscofirepower_threat_defense

[{"status": "affected", "version": "6.5.0", "lessThan": "6.5.0.5", "versionType": "custom"}]unknown

CiscoCisco Adaptive Security Appliance (ASA) Software

[{"status": "affected", "version": "n/a"}]unknown