Critical Path Traversal in Cisco ASA & FTD (CVE‑2020‑3452) Allows File Disclosure
What It Is – Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input‑validation flaw. A crafted HTTP request with directory‑traversal sequences can read arbitrary files from the device’s web‑services file system.
Exploitability – Publicly disclosed; proof‑of‑concept requests exist. CVSS 9.8 (Critical).
Affected Products – Cisco ASA (all supported versions) and Cisco Firepower Threat Defense (FTD).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that management interfaces are hardened and that configuration baselines are enforced – a core control objective for “Secure Configuration Management.”
- Evidence of timely patching and validation feeds directly into audit trails required by buyers demanding demonstrable trust.
- Continuous monitoring of device logs for anomalous HTTP requests provides the defensible evidence enterprises need to prove due diligence.
Recommended Actions
- Apply Cisco’s security advisory patch or upgrade to a version where the flaw is remediated.
- Verify that the management UI is restricted to trusted networks (e.g., VPN, ACLs).
- Enable and forward detailed HTTP access logs to a SIEM for continuous monitoring.
- Capture patch‑status evidence in your control‑mapping repository to demonstrate compliance.
Source: CISA KEV – CVE‑2020‑3452