The vulnerability resides in the VPN web services component of Cisco's Secure Firewall Adaptive Security Appliance and Threat Defense Software. Improper validation of user‑supplied data in HTTP requests allows an unauthenticated, remote attacker to inject and execute arbitrary HTML or script code in the browser of a user accessing the device. The injection occurs when the user follows a malicious link that submits crafted input to the application. Based on the nature of XSS, it is inferred that this capability could be used to hijack user sessions, steal credentials, or launch further attacks against the network.

Affected products are Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Version information is not specified, so all current releases may be vulnerable until Cisco issues a patch.

The vulnerability has a CVSS score of 6.1, indicating moderate impact, while the EPSS score of less than 1% suggests a low chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no public exploitation has been documented. The attack vector is remote, unauthenticated, and relies on a user's browser that connects to the VPN web portal; the attacker does not need to compromise the device itself. Given the low exploitation probability but the potential for client‑side compromise, monitoring for suspicious links and applying the vendor patch remains critical.