{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T21:47:37.879Z",
  "tag": {
    "id": "cisco-asa",
    "label": "Cisco ASA",
    "isStack": false,
    "url": "https://pwn.watch/t/cisco-asa",
    "feed": "https://pwn.watch/t/cisco-asa/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "cisco-adaptive-security-appliance-asa-cve-2014-2120",
      "title": "Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS)",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120",
      "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2014-2120"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-12",
      "closedAt": "2024-11-12",
      "updatedAt": "2024-11-12",
      "summary": "Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. Added to the CISA KEV catalog on 2024-11-12. CVE-2014-2120 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481",
      "title": "Cisco ASA and FTD Denial-of-Service",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481",
      "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisco-ftd",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20481"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-10-23",
      "closedAt": "2024-10-24",
      "updatedAt": "2024-10-24",
      "summary": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. Added to the CISA KEV catalog on 2024-10-24.",
      "xPost": null
    },
    {
      "slug": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "title": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "json": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisco-ftd",
        "zero-day",
        "espionage",
        "firewall",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20353",
        "CVE-2024-20359"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-04-24",
      "closedAt": "2024-04-24",
      "updatedAt": "2024-04-24",
      "summary": "Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.",
      "xPost": null
    },
    {
      "slug": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259",
      "title": "Cisco ASA and FTD Information Disclosure",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259",
      "json": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisco-ftd",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2020-3259"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-02-15",
      "closedAt": "2024-02-15",
      "updatedAt": "2024-02-15",
      "summary": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. Added to the CISA KEV catalog on 2024-02-15. CISA lists known use in ransomware campaigns. CVE-2020-3259 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "cisco-adaptive-security-appliance-asa-cve-2014-2120",
      "incidentTitle": "Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-12",
      "title": "CISA added CVE-2014-2120 to the KEV catalog (federal deadline 2024-12-03)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-cve-2014-2120"
    },
    {
      "incident": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481",
      "incidentTitle": "Cisco ASA and FTD Denial-of-Service",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-24",
      "title": "CISA added CVE-2024-20481 to the KEV catalog (federal deadline 2024-11-14)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481"
    },
    {
      "incident": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481",
      "incidentTitle": "Cisco ASA and FTD Denial-of-Service",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-23",
      "title": "CVE-2024-20481 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20481",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2024-20481"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CVE-2024-20353 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20353",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CVE-2024-20359 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20359",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CISA added CVE-2024-20353 to the KEV catalog (federal deadline 2024-05-01)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CISA added CVE-2024-20359 to the KEV catalog (federal deadline 2024-05-01)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "Cisco Talos discloses the ArcaneDoor campaign; Cisco ships fixes",
      "body": null,
      "sourceUrl": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259",
      "incidentTitle": "Cisco ASA and FTD Information Disclosure",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-15",
      "title": "CISA added CVE-2020-3259 to the KEV catalog (federal deadline 2024-03-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259"
    }
  ]
}