Is CVE-2020-3164 being actively exploited?

CVE-2020-3164 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2020-3164?

CVE-2020-3164 has a CVSS 3.1 base score of 5.3 (MEDIUM).

CVE-2020-3164

MEDIUM · CVSS 5.3EPSS 1.3%EU EUVD

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated remote attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific HTTP request headers. An attacker could exploit this vulnerability by sending a malformed HTTP request to an affected device. A successful exploit could allow the attacker to trigger a prolonged status of high CPU utilization relative to the GUI process(es). Upon successful exploitation of this vulnerability, an affected device will still be operative, but its response time and overall performance may be degraded.

Key facts

CVSS score: 5.3 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE): CWE-20
EPSS score: 1.3% (69th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2020-24435)
Published: March 4, 2020
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2020-24435 in the EU Vulnerability Database. Last updated in EUVD on November 15, 2024.

View on the EU Vulnerability Database

Affected products

cisco / cloud email security
cisco / content security management appliance
cisco / email security appliance
cisco / web security appliance

Certified products that may be affected

6 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Web Security Appliance with AsyncOS 11.8 - Cisco Systems, Inc. - Common Criteria 567-LSS - active
Cisco Email Security Appliance with AsyncOS 13.0 - Cisco Systems, Inc. - Common Criteria 495-LSS - archived
Cisco Web Security Appliance 10.5 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-10799-2017 - archived
Cisco Email Security Appliance 9.8 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-10798-2017 - archived
Cisco Email Security Appliance v9.1 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-10631-2015 - archived

See all 6 in the Security Certifications Explorer.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cont-sec-gui-dos-nJ625dXb(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain