A flaw in the SSL VPN web server of the Cisco Secure Firewall ASA and FTD allows an unauthenticated, remote attacker to trigger a denial of service by sending a stream of malformed HTTP requests. The vulnerability stems from improper memory management identified as CWE-244. Successful exploitation forces the device to reload, interrupting legitimate VPN traffic and rendering the firewall inoperative until it recovers.

The affected products are Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Precise version information is not provided in the advisory, so all releases prior to the fix should be considered vulnerable until a vendor update is applied.

With a CVSS base score of 8.6 the flaw presents a high severity risk, but the EPSS score of under 1% indicates that exploitation is currently unlikely and it is not listed in the CISA KEV catalog. Nevertheless, because the attack requires no credentials and can be carried out from any network location that can reach the VPN web server, it poses a significant threat to uptime and availability for unattended devices.