A flaw in the handling of Datagram TLS (DTLS) messages on Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software allows an unauthenticated remote attacker to craft a DTLS traffic stream that causes the device to reload, resulting in a loss of availability. The vulnerability stems from improper resource management while processing specific DTLS packets, and it can lead to a complete denial of service for the firewall. The problem is classified as CWE‑772, which indicates that resources are not being released correctly during operation.

The affected products are Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) Software, specifically on 3100 Series and 4200 Series devices. Version information is not provided in the advisory, so all current releases of these products are considered potentially vulnerable until a corrected release is issued.

The CVSS score of 8.6 reflects a high severity risk, while the EPSS score of less than 1% indicates that the likelihood of an active exploit is low at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker does not need authentication to exploit the weakness; the attack vector is remote, relying on the ability to send crafted DTLS packets to the firewall over the network. Successful exploitation would cause the device to reload, leading to a temporary service outage until the device recovers.