A flaw in the Remote Access SSL VPN, HTTP management and MUS components of Cisco Secure Firewall ASA and FTD trusts unvalidated user input, allowing an unauthenticated attacker to send crafted packets that exhaust device memory and force the device to stop responding. The result is a loss of availability; the vulnerability does not compromise confidentiality or integrity of data. It is categorized as a memory‑leak issue (CWE‑401).

The defect affects Cisco Secure Firewall Adaptive Security Appliance (ASA) software and Cisco Secure Firewall Threat Defense (FTD) software. No specific firmware versions are listed in the advisory, so all current releases are presumed vulnerable until a fix is installed.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of below 1 % reflects a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out remotely over the network by an adversary who does not need any credentials; the attacker simply sends malformed SSL VPN packets to the device, causing a memory exhaustion that culminates in a denial of service. Because no authentication is required, the risk is primarily to service availability rather than data confidentiality or integrity.