The vulnerability is in the Lua interpreter used by the Remote Access SSL VPN of Cisco Secure Firewall ASA and FTD. An authenticated remote attacker who has established a VPN connection can send specially crafted HTTP packets. The interpreter trusts user input without validation, which can cause the device to reload unexpectedly and result in a denial‑of‑service condition. This disruption affects firewall operation but does not impact the management or MUS interfaces.

Affected systems include Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. No specific versions are listed in the advisory; administrators should verify that their deployed firmware is not vulnerable by consulting Cisco’s security portal. The flaw applies to any deployment of the Remote Access SSL VPN feature that is reachable by an attacker who can authenticate to the VPN.

Risk assessment: The CVSS score of 7.7 classifies this as a high‑severity vulnerability. The EPSS score of less than 1% indicates a low probability of active exploitation, and it is not listed in the CISA KEV catalog. The vulnerability requires authenticated VPN access, limiting the threat surface to users with valid VPN credentials, typically a smaller set of trusted individuals or devices.