The vulnerability arises from improper error handling when an ASA or FTD device that is part of a cluster runs out of memory while replicating access control rules. An unauthenticated, remote attacker can send traffic that should otherwise be denied, allowing that traffic to be forwarded through the device. Successful exploitation would enable the attacker to reach devices within protected networks, compromising network segmentation. The weakness is classified as CWE-284.

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software are affected. The issue is tied to devices that participate in a cluster and may require memory for ACL replication; version details are not supplied, so administrators should verify whether their ASA or FTD deployments are clustered and whether the current firmware incorporates the fix.

The CVSS score of 5.8 indicates moderate severity. The EPSS score of less than 1% reflects a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector involves remote, unauthenticated traffic sent to a cluster member under memory pressure; while the trigger may be difficult to achieve, it is feasible with sufficient traffic, leading to a moderate exposure that could enable lateral movement into a protected network.