A flaw in the TLS cryptography implementation of the Snort 3 Detection Engine within Cisco Secure Firewall Threat Defense (FTD) Software enables an attacker to send a specially crafted TLS packet, causing the engine to unexpectedly restart. The resulting restart forces the device to drop network traffic, creating a denial of service condition. The weakness is classified as CWE‑388, an insecure interface or protocol vulnerability that can lead to service disruption.

Cisco Secure Firewall Threat Defense (FTD) Software is impacted. No specific product versions are listed in the advisory; therefore, all currently deployed FTD instances are potentially vulnerable unless documented otherwise by the vendor.

The vulnerability carries a CVSS score of 5.8, indicating moderate severity, and an EPSS score below 1 %, implying a low likelihood of exploitation at present. The vulnerability is not present in Cisco’s Known Exploited Vulnerabilities catalog. Based on the description, the attack vector is remote and unauthenticated: an external actor can target the affected firewall by transmitting the crafted TLS packet over a network connection. Successful exploitation would cause the Snort 3 engine to restart, leading to a denial of service that affects all traffic processed by the device.