In light of recent events, probably best to make this ASA vuln public in public interest: https://github.com/GossiTheDog/Exploits/blob/main/Cisco-CVE-2020-3259.sh
If you get <argument> back with toke inside, not vuln. If you get a memory dump back, you vuln.
The path exists even with webvpn disabled, it's the host checker.
Credits to person who found it, don't know if they want to be named.