Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) known exploited vulnerabilities, ranked
CISA lists 6 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) CVEs as exploited in the wild. 0 were added in the last 12 months and 2 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2020-3452: EPSS 99.99%, added 2021-11-03
- CVE-2020-3580: EPSS 85.6%, used in ransomware, added 2021-11-03
- CVE-2020-3259: EPSS 71.8%, used in ransomware, added 2024-02-15
- CVE-2024-20353: EPSS 70.7%, added 2024-04-24
- CVE-2024-20359: EPSS 19.4%, added 2024-04-24
All 6 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2020-3452 | ASA and FTD Read-Only Path Traversal | 99.99% | – | 2021-11-03 | 2022-05-03 |
| 2 | CVE-2020-3580 | ASA and FTD Cross-Site Scripting (XSS) | 85.6% | Yes | 2021-11-03 | 2022-05-03 |
| 3 | CVE-2020-3259 | ASA and FTD Information Disclosure | 71.8% | Yes | 2024-02-15 | 2024-03-07 |
| 4 | CVE-2024-20353 | ASA and FTD Denial of Service | 70.7% | – | 2024-04-24 | 2024-05-01 |
| 5 | CVE-2024-20359 | ASA and FTD Privilege Escalation | 19.4% | – | 2024-04-24 | 2024-05-01 |
| 6 | CVE-2024-20481 | ASA and FTD Denial-of-Service | 15.8% | – | 2024-10-24 | 2024-11-14 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Cisco KEV CVEs · other Cisco products: Catalyst SD-WAN Manager · IOS and IOS XE Software · IOS XR · Small Business RV160, RV260, RV340, and RV345 Series Routers · IOS software · free KEV badge for Cisco · all vendors