Cisco ASA/FTD CVE-2020-3259: VPN Memory Leak Used by Akira
Fixed in 2020 but used for Akira ransomware entry years later; any ASA or FTD that ran a vulnerable build with AnyConnect or WebVPN enabled should be assumed to have leaked VPN credentials until those passwords are reset.
Must act: Owners of Cisco ASA or FTD devices with AnyConnect SSL VPN, Clientless SSL VPN or AnyConnect IKEv2 client services that ran a release older than the fixed builds at any point while internet-facing.
Can relax: Devices without remote access VPN or WebVPN features, Firepower Management Center (not affected), and fleets that upgraded long ago and have rotated VPN credentials since.
- Run show version on every ASA and FTD and confirm it is on a current supported release, not just past the 2020 fixed builds.
- Find out when each VPN-enabled device first moved off a vulnerable build; treat every VPN, local and pre-shared credential not changed since then as exposed.
- Reset those passwords and change local account passwords and pre-shared keys in the device configuration.