A flaw in the OSPF protocol handling within Cisco Secure Firewall ASA and FTD software allows an unauthenticated adjacent attacker to send crafted OSPF LSU packets that trigger a memory write outside the packet buffer, forcing the device to reload. The resulting reload causes a denial‑of‑service condition for network connectivity, though no privilege escalation or data compromise occurs. The weakness corresponds to insufficient input validation over packet data.

Products affected are Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. No specific firmware version exclusions are listed; all current releases are potentially vulnerable until a patched version is deployed.

The vulnerability has a CVSS score of 6.1, indicating moderate severity, and an EPSS score of less than 1 %, showing a very low probability of exploitation in the wild. The attack requires an unauthenticated attacker adjacent to the device and requires the OSPF canonicalization debug command (debug ip ospf canon) to be enabled. The vector does not involve remote code execution and is contained within the local network segment. The vulnerability is not listed in the CISA KEV catalog.