The vulnerability allows an unauthenticated attacker to exhaust the device’s memory by repeatedly creating TLS connections, such as through repeated EAP authentication attempts or a machine‑in‑the‑middle resetting TLS sessions. This improper memory resource handling can cause the device to reload unexpectedly, resulting in a denial of service. The weakness falls under resource exhaustion and is identified as CWE‑771, leading to loss of availability for the affected system.

The affected product is Cisco IOS XE Software. No specific version information is provided in the data, so all releases of the CISCO IOS XE platform that include the vulnerable TLS library are potentially affected. Attacks are typically launched from an adjacent network or via a man‑in‑the‑middle position that can reset TLS connections.

The CVSS score of 7.4 indicates a high severity level, and while EPSS data is not available, the lack of authentication requirement and the possibility of an attacker on the same network make exploitation plausible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated adjacent attacker that can trigger TLS or EAP traffic to a device, or an attacker able to perform a MITM reset of TLS sessions. Successful exploitation would cause a memory leak, leading to a reload and device downtime.