Security readout for executives and security teams
Plain-English summary
Cisco ASA and Firepower Threat Defense devices can mishandle specially crafted FTP traffic, allowing FTP sessions to pass without effective inspection. This is not described as device takeover, but it can weaken a control organizations rely on to enforce FTP policy and monitor traffic.
Executive priority
Treat this as a moderate-priority control-bypass issue. It should not outrank critical remote-code-execution flaws, but organizations relying on Cisco FTP inspection for perimeter enforcement should validate exposure and schedule vendor-guided remediation.
Technical view
CVE-2020-3564 is an unauthenticated remote FTP inspection bypass caused by ineffective FTP flow tracking in Cisco ASA Software and FTD Software. Crafted FTP traffic sent through an affected device can bypass FTP inspection and complete FTP connections. CVSS v3.0 score is 5.8, medium severity.
Likely exposure
Exposure is most likely where Cisco ASA or FTD devices inspect FTP traffic, especially perimeter, DMZ, or partner-transfer paths. The provided sources do not list affected versions in detail, so teams must compare deployed software against Cisco guidance.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation is described as remote, unauthenticated, and requiring crafted FTP traffic through an affected device, with impact limited to bypassing FTP inspection.
Researcher notes
The evidence supports an FTP inspection bypass with low integrity impact, not confidentiality loss, denial of service, or device compromise. The bundle lacks fixed-version details, workarounds, indicators, and proof of exploitation, so avoid stronger claims without Cisco advisory confirmation.
Mitigation direction
- Review Cisco's advisory for affected releases and vendor-supported fixes.
- Inventory ASA and FTD devices that process or inspect FTP traffic.
- Prioritize remediation for internet-facing or high-trust FTP transfer paths.
- Reduce unnecessary FTP exposure where business workflows allow.
- Monitor vendor guidance for version-specific workarounds or upgrade paths.
Validation and detection
- Identify deployed Cisco ASA and FTD software versions.
- Confirm whether FTP inspection is enabled in relevant traffic policies.
- Map FTP flows crossing affected security boundaries.
- Compare device versions and configurations against Cisco's advisory.
- Review FTP logs for unexpected completed sessions across restricted paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-3564 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.8MediumVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- 20201021 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Bypass VulnerabilityCVE reference · vendor-advisory, x_refsource_CISCO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.