The vulnerability arises from improper error handling when an ASA or FTD device, participating in a cluster, exhausts memory while replicating access control rules. An unauthenticated, remote attacker can send traffic that should otherwise be denied, bypassing the firewall’s policies. If the exploit succeeds, the attacker gains the ability to reach devices within protected networks, compromising network segmentation and potentially exposing sensitive data. The weakness is classified as CWE-284, indicating an access control flaw.

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software are affected. The issue is tied to devices that are members of a cluster and may require memory for ACL replication; version details are not supplied, so administrators should verify whether their ASA or FTD deployments are clustered and whether the current firmware incorporates the patch.

The CVSS score of 5.8 indicates moderate severity. The EPSS score of less than 1% reflects a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector involves remote, unauthenticated traffic sent to a cluster member under memory pressure; while difficult to trigger, it is feasible with sufficient traffic, resulting in a moderate exposure that could enable lateral movement into a protected network.