Reminder: Patch Cisco ASA / FTD Devices (CVE-2020-3452). Exploitation Continues
Last Updated: 2020-08-04 11:20:29 UTC
by Johannes Ullrich (Version: 1)
Just a quick reminder: We are continuing to see small numbers of exploit attempts against CVE-2020-3452. Cisco patched this directory traversal vulnerability in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The exploit is rather simple and currently used to find vulnerable systems by reading benign LUA source code files.
GET /+CSCOE+/translation-table?=mst&textdomain=/%bCSCOE%2b/portalinc.lua@default-languaqe&lang=../ HTTP/1.1
Out honeypot isn't emulating this vulnerability well right now, so we are not seeing followup attacks.
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS Technology Institute