CVERadar
HIGH · CVSS 3.1 7.5CISA KEV · added 2021-11-03Exploit-DBPublic PoCEPSS 99.99% (p100)Threat level 82

CVE-2020-3452: Cisco ASA and FTD Read-Only Path Traversal Vulnerability

Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · NVD published 2020-07-23 · posted 2026-10-21 · last modified 2026-08-12

What it is

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.

WeaknessCWE-20CWE-22
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (source: [email protected])
CISA due date2022-05-03 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsStealth → Collection

Exploitation evidence

First exploit evidence seen: 2020-07-24 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2021-11-03. Source

Public exploit code

Exploit-DB

  • EDB-48722: Cisco Adaptive Security Appliance Software 9.11 - Local File Inclusion (2020-07-28)
  • EDB-48871: Cisco ASA and FTD 9.6.4.42 - Path Traversal (2020-10-12)
  • EDB-49262: Cisco ASA 9.14.1.10 and FTD 6.6.0.1 - Path Traversal (2) (2020-12-15)

GitHub proof-of-concept repositories

23 public repositories from 23 accounts, first seen 2020-07-24. Most starred: darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter (98 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Exploit-DB (OffSec) · nomi-sec/PoC-in-GitHub.

Defend the Chain

The attack chain for CVE-2020-3452 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.

Threat level 82/100
Defender level 1 · 0 XP
Chain links broken: 0/2

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Pick a red technique card on the board, then choose the defence that stops it.

Defend against T1202 Indirect Command Execution CTID: exploitation technique

CVE-2020-3452 is a vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system.

How to fix it

CISA required action

Apply updates per vendor instructions. (source: CISA KEV)

Fixed versions

  • cisco adaptive security appliance software: upgrade to 9.6.4.42 or later (affected from 9.6)
  • cisco adaptive security appliance software: upgrade to 9.8.4.20 or later (affected from 9.8)
  • cisco adaptive security appliance software: upgrade to 9.9.2.74 or later (affected from 9.9)
  • cisco adaptive security appliance software: upgrade to 9.10.1.42 or later (affected from 9.10)
  • cisco adaptive security appliance software: upgrade to 9.12.3.12 or later (affected from 9.12)
  • cisco adaptive security appliance software: upgrade to 9.13.1.10 or later (affected from 9.13)
  • cisco adaptive security appliance software: upgrade to 9.14.1.10 or later (affected from 9.14)
  • cisco secure firewall threat defense: upgrade to 6.2.3.16 or later (affected from 6.2.3)
  • cisco secure firewall threat defense: upgrade to 6.3.0.6 or later (affected from 6.3.0)
  • cisco secure firewall threat defense: upgrade to 6.4.0.10 or later (affected from 6.4.0)
  • cisco secure firewall threat defense: upgrade to 6.5.0.5 or later (affected from 6.5.0)
  • cisco secure firewall threat defense: upgrade to 6.6.0.1 or later (affected from 6.6.0)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

  • M1057 Data Loss Prevention (for T1005) : Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

Detection Generic guidance

  • Collection: Watch for bulk reads of databases, file shares or mailboxes by the affected service.

Response checklist Generic guidance

  1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
  2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
  3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
  4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

Sources