CVE-2020-3452highunder attackCWE-20

CVE-2020-3452: high-severity vulnerability in Cisco Adaptive Security Appliance (ASA) Software

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

Published · Updated

Follow this CVE+ Monitor Cisco Adaptive Security Appliance+ Monitor Cisco Firepower Threat Defense

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 100%
from disclosure to weapon2 days
Published on NVDJul 22
1st PoC+2d
CISA KEV+469d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Cisco ASA and FTD web services allows attackers to read files they shouldn't access by sending specially crafted web requests. This matters because sensitive information stored in the web service area could be exposed without needing to log in.

Technical detail

Path traversal vulnerability in HTTP request URL processing of Cisco ASA and FTD web services interface, exploitable remotely without authentication when WebVPN or AnyConnect is configured. Lack of input validation permits directory traversal sequences in HTTP requests, allowing attackers to access arbitrary files within the web services file system; impact limited to web service scope, not underlying system files.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Cisco · Cisco Adaptive Security Appliance (ASA) Software
public PoCs found — 51
exploitdbwww.exploit-db.com/exploits/48871unverifiedexploitdbwww.exploit-db.com/exploits/48722unverifiedexploitdbwww.exploit-db.com/exploits/49262unverifiedgithubgithub.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter★ 97githubgithub.com/cygenta/CVE-2020-3452★ 26githubgithub.com/PR3R00T/CVE-2020-3452-Cisco-Scanner★ 25githubgithub.com/3ndG4me/CVE-2020-3452-Exploit★ 24githubgithub.com/0x5ECF4ULT/CVE-2020-3452★ 23githubgithub.com/murataydemir/CVE-2020-3452★ 8githubgithub.com/fuzzlove/Cisco-ASA-FTD-Web-Services-Traversal★ 6githubgithub.com/grim3/CVE-2020-3452★ 4githubgithub.com/foulenzer/CVE-2020-3452★ 3githubgithub.com/faisalfs10x/Cisco-CVE-2020-3452-shodan-scanner★ 2githubgithub.com/XDev05/CVE-2020-3452-PoC★ 2githubgithub.com/Loneyers/cve-2020-3452★ 2githubgithub.com/paran0id34/CVE-2020-3452★ 1githubgithub.com/ludy-dev/Cisco-ASA-LFI★ 1githubgithub.com/Aviksaikat/CVE-2020-3452★ 1githubgithub.com/Cappricio-Securities/CVE-2020-3452★ 1githubgithub.com/curtishoughton/CVE-2020-3452-Cisco-Python-Scanner★ 0githubgithub.com/abrewer251/CVE-2020-3452_Cisco_ASA_PathTraversal★ 0githubgithub.com/iveresk/cve-2020-3452★ 0githubgithub.com/Gh0st0ne/http-vuln-cve2020-3452.nse★ 0githubgithub.com/mr-r3b00t/CVE-2020-3452★ 0githubgithub.com/sujaygr8/CVE-2020-3452★ 0githubgithub.com/Veids/CVE-2020-3452_auto★ 0vulncheckvulncheck.com/xdb/c571acc5a812unverifiedvulncheckvulncheck.com/xdb/2a69a67b6102unverifiedvulncheckvulncheck.com/xdb/7d16c3139c04unverifiedvulncheckvulncheck.com/xdb/38dc36ab63a7unverifiedvulncheckvulncheck.com/xdb/2844089d4205unverifiedvulncheckvulncheck.com/xdb/ea4e2fe7fa5bunverifiedcve_referencepacketstormsecurity.com/files/159523/Cisco-ASA-FTD-9.6.4.42-Path-Traversal.htmlunverifiedcve_referencepacketstormsecurity.com/files/160497/Cisco-ASA-9.14.1.10-FTD-6.6.0.1-Path-Traversal.htmlunverifiedvulncheckvulncheck.com/xdb/6f0ce488573dunverifiedvulncheckvulncheck.com/xdb/359345081311unverifiedvulncheckvulncheck.com/xdb/ce846e08db40unverifiedvulncheckvulncheck.com/xdb/9994be2cbc89unverifiedvulncheckvulncheck.com/xdb/aa17afb12c79unverifiedvulncheckvulncheck.com/xdb/cd0659505a89unverifiedcve_referencepacketstormsecurity.com/files/158646/Cisco-ASA-FTD-Remote-File-Disclosure.htmlunverifiedvulncheckvulncheck.com/xdb/c9fadd0b730funverifiedcve_referencepacketstormsecurity.com/files/158647/Cisco-Adaptive-Security-Appliance-Software-9.11-Local-File-Inclusion.htmlunverifiedvulncheckvulncheck.com/xdb/46d55b924a43unverifiedvulncheckvulncheck.com/xdb/fb8cdd3b2bf7unverifiedvulncheckvulncheck.com/xdb/6b23e00dd9c9unverifiedvulncheckvulncheck.com/xdb/9bf142c2d239unverifiedvulncheckvulncheck.com/xdb/765a6e6e3a97unverifiedvulncheckvulncheck.com/xdb/14238ed757f7unverifiedvulncheckvulncheck.com/xdb/582d43abc71funverifiedvulncheckvulncheck.com/xdb/12e485c619ddunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Adaptive Security Appliance (ASA) Software

In the same product, most dangerous first.

CVE-2020-3580MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 85.6%KEVCVE-2020-3259HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure VulnerabilityEPSS 71.5%KEVCVE-2024-20353HIGHCVE-2024-20353EPSS 69.8%KEVCVE-2023-20269MEDIUMCVE-2023-20269EPSS 26.6%KEVCVE-2024-20359MEDIUMCVE-2024-20359EPSS 18.8%KEVCVE-2024-20481MEDIUMCVE-2024-20481EPSS 15.9%KEV