CVE-2020-3259

설명

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow th...

영향 제품·버전

공급사 Cisco

제품 Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)

영향 버전 n/a, 6.2.3, 6.3.0, 6.4.0, 6.5.0, 9.8, 9.9, 9.10, 9.12, 9.13, >= 6.2.3 < 6.2.3.16, >= 6.3.0 < 6.3.0.6, >= 6.4.0 < 6.4.0.9, >= 6.5.0 < 6.5.0.5, >= 9.8 < 9.8.4.20, >= 9.9 < 9.9.2.67, >= 9.10 < 9.10.1.40, >= 9.12 < 9.12.3.9, >= 9.13 < 9.13.1.10

수정 버전 6.2.3.16, 6.3.0.6, 6.4.0.9, 6.5.0.5, 9.8.4.20, 9.9.2.67, 9.10.1.40, 9.12.3.9, 9.13.1.10

조치 방법

• 공급사가 제공한 최신 보안 업데이트 적용
• 자사 보유 제품과 영향 버전의 일치 여부 확인
• 외부 노출 서비스와 비정상 인증·접속 로그 점검
• 패치가 어려우면 공급사 완화조치와 접근통제 적용

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE CWE-200

KEV 등록일 2024.02.15

랜섬웨어 캠페인 사용 확인됨

CISA 비고 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB; https://nvd.nist.gov/vuln/detail/CVE-2020-3259

EPSS 데이터 기준일 2026.06.27