CVE-2020-3452

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation flaw (CWE-20) in how HTTP requests process URLs. An attacker triggers it by sending a crafted HTTP request containing directory traversal character sequences to the web services interface of an affected device. A successful exploit is read-only: the attacker can view arbitrary files within the web services file system, potentially leaking sensitive device or configuration content, but cannot modify the device or take full control. Any organization running ASA or FTD software with the web services interface reachable — commonly an internet-facing VPN or web portal — is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with a reported ~100% EPSS probability of exploitation, indicating it is being actively exploited in the wild; ransomware use is unknown.

What to do: Apply Cisco's fixed software releases for ASA and FTD as directed in the vendor advisory. Until patched, restrict access to the device's web services/WebVPN interface to trusted source addresses or disable web services if not in use. Review device HTTP logs for crafted requests containing directory traversal sequences against the web portal, which would indicate exploitation attempts.