# CVE-2020-3580 — Cisco Adaptive Security Appliance (ASA) Software **CISA KEV** · **Ransomware** > As of 2025-10-21, CVE-2020-3580 is a MEDIUM-severity vulnerability in Cisco Adaptive Security Appliance (ASA) Software, CVSS v3.1 6.1, EPSS 85.5% (99.7th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), with a US federal remediation deadline of 2022-05-03, and CISA links it to known ransomware campaigns. Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2020-3580, most recently “Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)”. **Last updated:** 2025-10-21 ## What is CVE-2020-3580? Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section. The record classifies CVE-2020-3580 under weakness class [CWE-79](https://intel.threadlinqs.com/cwe/CWE-79). Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs a user to take an action first. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 2193 days ago. ## Severity and exploitation probability - **CVSS v3.1 base score:** 6.1 — MEDIUM (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`) - **EPSS (FIRST):** 85.5% probability of exploitation in the next 30 days, higher than 99.7% of all scored CVEs - **CISA KEV:** Listed since 2021-11-03, federal remediation deadline 2022-05-03 — used in known ransomware campaigns - **Threadlinqs priority:** 10/10 — CISA lists it as used in ransomware, which Threadlinqs scores at the maximum - **Published:** 2020-10-21, last modified 2025-10-21 ## Is CVE-2020-3580 being exploited? CISA added CVE-2020-3580 to the Known Exploited Vulnerabilities catalog on 2021-11-03, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2022-05-03 under BOD 22-01. CISA flags the vulnerability as one used in known ransomware campaigns. Weaponised exploit code for CVE-2020-3580 is publicly available. 5 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (`http/cves/2020/CVE-2020-3580.yaml`). It currently carries a trending score of 50 in the Threadlinqs vulnerability feed. - [adarshvs/CVE-2020-3580](https://github.com/adarshvs/CVE-2020-3580) (github) - [Hudi233/CVE-2020-3580](https://github.com/Hudi233/CVE-2020-3580) (github) - [catatonicprime/CVE-2020-3580](https://github.com/catatonicprime/CVE-2020-3580) (github) - [cruxN3T/CVE-2020-3580](https://github.com/cruxN3T/CVE-2020-3580) (github) - [trickest/cve](https://github.com/trickest/cve/blob/main/2020/CVE-2020-3580.md) (trickest) ## Affected products and versions - [Cisco](https://intel.threadlinqs.com/vendors/cisco): Adaptive Security Appliance (ASA) Software ## How to fix CVE-2020-3580 Because CVE-2020-3580 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2022-05-03. No vendor patch reference has been recorded for CVE-2020-3580 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise. ## Threat activity tracking CVE-2020-3580 1 tracked threat in the Threadlinqs corpus references CVE-2020-3580, either in the campaign’s CVE list or as an indicator on the campaign record. - [Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)](https://intel.threadlinqs.com/threat/TL-2026-3127) — HIGH · 2026-10-09 ## Sources Enriched from CVE.org, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on 2026-10-10. **Vendor advisory and patch** - [tools.cisco.com — vendor advisory](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe) Canonical: https://intel.threadlinqs.com/cve/CVE-2020-3580 Full detection coverage and IOCs for threats exploiting CVE-2020-3580 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp