The vulnerability originates from improper handling of OSPF protocol packets, leading to memory corruption. An attacker can send crafted packets from an adjacent network, causing the system to overwrite critical memory areas. The resulting crash forces the device to reboot, which renders the firewall inactive and results in a denial of service. The weakness is classified as CWE-787, indicating an out‑of‑bounds write.

The affected systems are Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. No specific product versions are listed in the advisory, so all instances of the listed systems that may still contain the vulnerability should be considered at risk.

The vulnerability’s CVSS score of 6.1 indicates moderate severity. The EPSS score is less than 1 %, showing a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The attacker runs unauthenticated and relies on being adjacent to the target device, which limits the attack surface to local or immediate network zones. Because of the low exploitation likelihood, the risk is moderate, but any successful exploit results in complete denial of service for the affected device.