CVE-2020-3580
CISA KEV RANSOMWARE
ACT NOW
Priority: 0.00
BB Relevance:
0/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.
CISA Known Exploited Vulnerability
Vendor / Product
Cisco — Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Date Added
2021-11-03
Remediation Due
2022-05-03
Ransomware Use
CONFIRMED
https://nvd.nist.gov/vuln/detail/CVE-2020-3580
Weakness Classification (1)
Affected Software (9)
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive_security_appliance_software | < 9.8.4.34 |
| cisco | adaptive_security_appliance_software | 9.9 – 9.9.2.85 |
| cisco | adaptive_security_appliance_software | 9.10 – 9.12.4.13 |
| cisco | adaptive_security_appliance_software | 9.13 – 9.13.1.21 |
| cisco | adaptive_security_appliance_software | 9.14 – 9.14.2.8 |
| cisco | adaptive_security_appliance_software | 9.15 – 9.15.1.15 |
| cisco | secure_firewall_threat_defense | < 6.4.0.12 |
| cisco | secure_firewall_threat_defense | 6.5.0 – 6.6.4 |
| cisco | secure_firewall_threat_defense | 6.7.0 – 6.7.0.2 |
References & Advisories (2)
US Government Resource
Patch
Vendor Advisory