---
title: "Cisco ASA/FTD CVE-2020-3259: VPN Memory Leak Used by Akira"
url: https://erroneo.us/security/briefs/cisco-asa-ftd-cve-2020-3259-memory-leak-akira/
description: "A 2020 ASA/FTD bug leaks memory, including VPN credentials, to unauthenticated requests; Akira ransomware used it in 2023-24. Patch and reset VPN passwords."
type: security-brief
section: "Security Digest"
date_published: 2020-05-06
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2020-3259"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco ASA/FTD CVE-2020-3259: VPN Memory Leak Used by Akira

**Verdict: Check exposure.** Fixed in 2020 but used for Akira ransomware entry years later; any ASA or FTD that ran a vulnerable build with AnyConnect or WebVPN enabled should be assumed to have leaked VPN credentials until those passwords are reset.

- **Who must act:** Owners of Cisco ASA or FTD devices with AnyConnect SSL VPN, Clientless SSL VPN or AnyConnect IKEv2 client services that ran a release older than the fixed builds at any point while internet-facing.
- **Who can relax:** Devices without remote access VPN or WebVPN features, Firepower Management Center (not affected), and fleets that upgraded long ago and have rotated VPN credentials since.
- **Affected:** ASA 9.5 and earlier, 9.6 before 9.6.4.41, 9.7, 9.8 before 9.8.4.20, 9.9 before 9.9.2.67, 9.10 before 9.10.1.40, 9.12 before 9.12.3.9, 9.13 before 9.13.1.10; FTD before 6.2.3.16, 6.3.0 before 6.3.0.6, 6.4.0 before 6.4.0.9, 6.5.0 before 6.5.0.5; Only with AnyConnect/Clientless SSL VPN (webvpn) or AnyConnect IKEv2 client services enabled
- **Fixed:** ASA 9.6.4.41, 9.8.4.20, 9.9.2.67, 9.10.1.40, 9.12.3.9, 9.13.1.10; 9.14 not vulnerable; FTD 6.2.3.16, 6.3.0.6, 6.4.0.9, 6.5.0.5; 6.6.0 not vulnerable; ASA 9.5 and earlier, 9.7 and FTD before 6.2.3: migrate to a fixed release
- **CVEs:** CVE-2020-3259
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run show version on every ASA and FTD and confirm it is on a current supported release, not just past the 2020 fixed builds.
2. Find out when each VPN-enabled device first moved off a vulnerable build; treat every VPN, local and pre-shared credential not changed since then as exposed.
3. Reset those passwords and change local account passwords and pre-shared keys in the device configuration.
4. Require MFA for all remote access VPN logins.
5. Make sure VPN authentication logs (RADIUS, syslog) are collected and retained so misuse can be traced.

### How to check if you are affected

- In RADIUS or VPN logs, look for a legitimate user's login followed shortly by a login with the same account from an unfamiliar IP; Truesec saw this pattern in Akira cases.
- Review AnyConnect sessions from hosting-provider or foreign IPs, especially for accounts that also logged in from their usual location the same day.
- Check for ransomware precursors after VPN logins: new local admins, RDP from VPN pools to servers, and disabled security tools.

## What happened

On May 6, 2020, Cisco published an [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB) for CVE-2020-3259 in Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software, as part of its May 2020 bundled release. A buffer tracking error in the web services interface lets an unauthenticated attacker send a crafted GET request and read device memory. Cisco says the leaked heap can include web cookies, usernames, email addresses and certificates. Mikhail Klyuchnikov and Nikita Abramov of Positive Technologies reported it. Cisco scores it CVSS 3.0 7.5 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2020-3259), with no workarounds.

The bug sat quietly for almost four years. On January 29, 2024, [Truesec](https://www.truesec.com/hub/blog/akira-ransomware-and-exploitation-of-cisco-anyconnect-vulnerability-cve-2020-3259) reported eight recent Akira ransomware cases where Cisco AnyConnect SSL VPN was the confirmed entry point. At least six of the devices ran vulnerable software. In the others, data was too thin to tell. Truesec said the leak can expose cleartext usernames and passwords. It saw no password spraying or brute force. Instead, a legitimate user's login was followed shortly by a malicious one with the same account. No public exploit existed, so Akira likely bought or built one.

## Who is affected

Only devices with AnyConnect SSL VPN or Clientless SSL VPN (`webvpn` with `enable`), or AnyConnect IKEv2 client services, are exposed. Fixed ASA builds are 9.6.4.41, 9.8.4.20, 9.9.2.67, 9.10.1.40, 9.12.3.9 and 9.13.1.10; 9.14 was never vulnerable. Fixed FTD builds are 6.2.3.16, 6.3.0.6, 6.4.0.9 and 6.5.0.5; 6.6.0 was never vulnerable. ASA 9.5 and earlier, 9.7 and FTD before 6.2.3 had to migrate. Firepower Management Center is not affected.

## Do you really need to act?

This is why a 2020 bug entered the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3259) on February 15, 2024, with a March 7 deadline and a known-ransomware flag. Many VPN gateways were never upgraded, and a credential leak outlives the patch. Cisco updated its advisory on February 21, 2024 to say it had learned of "additional attempted exploitation" in the wild that month.

Today, most ASA and FTD fleets are far past these builds. Later bugs have also forced upgrades, including CVE-2024-20353 and CVE-2024-20359 (ArcaneDoor), CVE-2025-20333 and CVE-2025-20362, and CVE-2026-20349, all now in KEV. So the patch itself is rarely the issue. The open question is credentials. If a VPN-enabled device ran a vulnerable build while internet-facing, Truesec's advice is to treat every credential not changed since the upgrade as compromised. That holds even where MFA was on, because the passwords can be reused elsewhere.

## What to do now

1. Run `show version` on each device and upgrade to a current supported ASA or FTD release.
2. Confirm which features are on: `show running-config webvpn` and `show running-config crypto ikev2 | include client-services`.
3. Find when each VPN device left a vulnerable build. Reset user passwords not changed since then, plus local accounts and pre-shared keys in the configuration.
4. Enforce MFA on all remote access VPN logins.
5. Turn on and keep VPN authentication logs; Truesec found limited logging in many victims.

## How to tell if you were hit

- In RADIUS or VPN logs, look for a user's normal login followed shortly by a login with the same account from an unfamiliar IP.
- Review AnyConnect sessions from hosting providers or unexpected countries.
- After any suspicious VPN session, check for RDP from the VPN pool to servers, new local admins and disabled security tools, the usual Akira precursors.

## Timeline

- May 6, 2020 — Cisco advisory and fixed releases.
- Jan 29, 2024 — Truesec links the bug to Akira ransomware intrusions.
- Feb 15, 2024 — CISA adds CVE-2020-3259 to KEV.
- Feb 21, 2024 — Cisco notes additional attempted exploitation.

## Sources

1. [Cisco — Cisco ASA Software and FTD Software Web Services Information Disclosure Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB)
2. [CVE record — CVE-2020-3259](https://www.cve.org/CVERecord?id=CVE-2020-3259)
3. [CISA — Known Exploited Vulnerabilities: CVE-2020-3259](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3259)
4. [Truesec — Akira Ransomware and Exploitation of Cisco Anyconnect Vulnerability CVE-2020-3259](https://www.truesec.com/hub/blog/akira-ransomware-and-exploitation-of-cisco-anyconnect-vulnerability-cve-2020-3259)

---
Source page: https://erroneo.us/security/briefs/cisco-asa-ftd-cve-2020-3259-memory-leak-akira/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt