The vulnerability arises from improper memory management within Cisco Secure Firewall Threat Defense’s decryption engine when processing TLS 1.2 traffic. An unauthenticated attacker can fabricate TLS 1.2 packets that trigger a memory corruption, causing the device to reload and disrupting network services. This results in a denial‑of‑service condition that affects all management and traffic functions of the affected device. The weakness is a classic memory leak/overflow issue classified under CWE‑404.

Cisco Secure Firewall Threat Defense (FTD) software is affected. All devices running the Do Not Decrypt exclusion feature with TLS 1.2 decryption enabled may be vulnerable. No specific version range is provided in the advisory, so operators should verify whether their deployed firmware includes the fix following the vendor’s guidance.

The CVSS v3.1 base score of 6.8 indicates a moderate severity. The EPSS score is reported as less than 1 %, implying a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is remote, unauthenticated, and only requires the ability to inject crafted TLS 1.2 traffic, which is feasible for anyone who can reach the firewall over the network.