erroneo.us
Search all guides⌘K

Security Digest · May 6, 2020 · Vulnerability · Network edge

Cisco ASA/FTD CVE-2020-3259: VPN Memory Leak Used by Akira

A 2020 ASA/FTD bug leaks memory, including VPN credentials, to unauthenticated requests; Akira ransomware used it in 2023-24. Patch and reset VPN passwords.

Published By erroneo.us Security Desk · Updated 3 min read4 sources

Our verdict

Check exposure

Fixed in 2020 but used for Akira ransomware entry years later; any ASA or FTD that ran a vulnerable build with AnyConnect or WebVPN enabled should be assumed to have leaked VPN credentials until those passwords are reset.

Who must act: Owners of Cisco ASA or FTD devices with AnyConnect SSL VPN, Clientless SSL VPN or AnyConnect IKEv2 client services that ran a release older than the fixed builds at any point while internet-facing.

Who can relax: Devices without remote access VPN or WebVPN features, Firepower Management Center (not affected), and fleets that upgraded long ago and have rotated VPN credentials since.

Affected
ASA 9.5 and earlier, 9.6 before 9.6.4.41, 9.7, 9.8 before 9.8.4.20, 9.9 before 9.9.2.67, 9.10 before 9.10.1.40, 9.12 before 9.12.3.9, 9.13 before 9.13.1.10
FTD before 6.2.3.16, 6.3.0 before 6.3.0.6, 6.4.0 before 6.4.0.9, 6.5.0 before 6.5.0.5
Only with AnyConnect/Clientless SSL VPN (webvpn) or AnyConnect IKEv2 client services enabled
Fixed in
ASA 9.6.4.41, 9.8.4.20, 9.9.2.67, 9.10.1.40, 9.12.3.9, 9.13.1.10; 9.14 not vulnerable
FTD 6.2.3.16, 6.3.0.6, 6.4.0.9, 6.5.0.5; 6.6.0 not vulnerable
ASA 9.5 and earlier, 9.7 and FTD before 6.2.3: migrate to a fixed release
CVSS
7.5 (v3.0, CNA)
EPSS
71.5% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Run show version on every ASA and FTD and confirm it is on a current supported release, not just past the 2020 fixed builds.
  2. Find out when each VPN-enabled device first moved off a vulnerable build; treat every VPN, local and pre-shared credential not changed since then as exposed.
  3. Reset those passwords and change local account passwords and pre-shared keys in the device configuration.
  4. Require MFA for all remote access VPN logins.
  5. Make sure VPN authentication logs (RADIUS, syslog) are collected and retained so misuse can be traced.

How to check if you are affected or compromised

  • In RADIUS or VPN logs, look for a legitimate user's login followed shortly by a login with the same account from an unfamiliar IP; Truesec saw this pattern in Akira cases.
  • Review AnyConnect sessions from hosting-provider or foreign IPs, especially for accounts that also logged in from their usual location the same day.
  • Check for ransomware precursors after VPN logins: new local admins, RDP from VPN pools to servers, and disabled security tools.

What happened#

On May 6, 2020, Cisco published an advisory for CVE-2020-3259 in Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software, as part of its May 2020 bundled release. A buffer tracking error in the web services interface lets an unauthenticated attacker send a crafted GET request and read device memory. Cisco says the leaked heap can include web cookies, usernames, email addresses and certificates. Mikhail Klyuchnikov and Nikita Abramov of Positive Technologies reported it. Cisco scores it CVSS 3.0 7.5 on the CVE record, with no workarounds.

The bug sat quietly for almost four years. On January 29, 2024, Truesec reported eight recent Akira ransomware cases where Cisco AnyConnect SSL VPN was the confirmed entry point. At least six of the devices ran vulnerable software. In the others, data was too thin to tell. Truesec said the leak can expose cleartext usernames and passwords. It saw no password spraying or brute force. Instead, a legitimate user's login was followed shortly by a malicious one with the same account. No public exploit existed, so Akira likely bought or built one.

Who is affected#

Only devices with AnyConnect SSL VPN or Clientless SSL VPN (webvpn with enable), or AnyConnect IKEv2 client services, are exposed. Fixed ASA builds are 9.6.4.41, 9.8.4.20, 9.9.2.67, 9.10.1.40, 9.12.3.9 and 9.13.1.10; 9.14 was never vulnerable. Fixed FTD builds are 6.2.3.16, 6.3.0.6, 6.4.0.9 and 6.5.0.5; 6.6.0 was never vulnerable. ASA 9.5 and earlier, 9.7 and FTD before 6.2.3 had to migrate. Firepower Management Center is not affected.

Do you really need to act?#

This is why a 2020 bug entered the KEV catalog on February 15, 2024, with a March 7 deadline and a known-ransomware flag. Many VPN gateways were never upgraded, and a credential leak outlives the patch. Cisco updated its advisory on February 21, 2024 to say it had learned of "additional attempted exploitation" in the wild that month.

Today, most ASA and FTD fleets are far past these builds. Later bugs have also forced upgrades, including CVE-2024-20353 and CVE-2024-20359 (ArcaneDoor), CVE-2025-20333 and CVE-2025-20362, and CVE-2026-20349, all now in KEV. So the patch itself is rarely the issue. The open question is credentials. If a VPN-enabled device ran a vulnerable build while internet-facing, Truesec's advice is to treat every credential not changed since the upgrade as compromised. That holds even where MFA was on, because the passwords can be reused elsewhere.

What to do now#

  1. Run show version on each device and upgrade to a current supported ASA or FTD release.
  2. Confirm which features are on: show running-config webvpn and show running-config crypto ikev2 | include client-services.
  3. Find when each VPN device left a vulnerable build. Reset user passwords not changed since then, plus local accounts and pre-shared keys in the configuration.
  4. Enforce MFA on all remote access VPN logins.
  5. Turn on and keep VPN authentication logs; Truesec found limited logging in many victims.

How to tell if you were hit#

  • In RADIUS or VPN logs, look for a user's normal login followed shortly by a login with the same account from an unfamiliar IP.
  • Review AnyConnect sessions from hosting providers or unexpected countries.
  • After any suspicious VPN session, check for RDP from the VPN pool to servers, new local admins and disabled security tools, the usual Akira precursors.

Timeline#

  • — Cisco advisory and fixed releases.
  • — Truesec links the bug to Akira ransomware intrusions.
  • — CISA adds CVE-2020-3259 to KEV.
  • — Cisco notes additional attempted exploitation.

Vulnerability records

  • CVE-2020-3259 · KEV 2024-02-15 · A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cisco — Cisco ASA Software and FTD Software Web Services Information Disclosure Vulnerability sec.cloudapps.cisco.com
  2. CVE record — CVE-2020-3259 cve.org
  3. CISA — Known Exploited Vulnerabilities: CVE-2020-3259 cisa.gov
  4. Truesec — Akira Ransomware and Exploitation of Cisco Anyconnect Vulnerability CVE-2020-3259 truesec.com