Improper validation of HTTP requests in the VPN web services component of Cisco Secure Firewall ASA and FTD allows an unauthenticated remote attacker to trick a user into visiting a malicious website that sends crafted HTTP requests to the device. The vulnerable device then reflects the malicious input back to the victim’s browser, enabling browser‑based attacks such as cross‑site scripting. The attacker cannot directly manipulate the device but can hijack the browser session of an authenticated or unauthenticated user. The vulnerability is classified as a CWE‑444 request smuggling flaw.

This issue affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software when the VPN web services endpoints are enabled. No specific version range is listed in the advisory, so all releases with the exposed VPN web services feature are potentially impacted.

The CVSS score is 4.3, indicating moderate severity, while the EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation requires user interaction; the attacker must persuade a user to visit a malicious site that sends crafted requests to the device. The attack can only happen when the affected device’s VPN web services endpoints are reachable from the user’s browser. Overall risk to the device itself is low, but the risk to end‑user browsers is significant for those who navigate to malicious sites designed to trigger the flaw.