CVE-2015-0677

CVE-2015-0677 describes a denial-of-service vulnerability in the XML parser of Cisco Adaptive Security Appliance (ASA) Software, affecting versions 8.4, 8.6, 9.0, 9.1, 9.2, and 9.3 when Clientless SSL VPN, AnyConnect SSL VPN, or AnyConnect IKEv2 VPN is in use. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted XML document, leading to a VPN outage or a device reload. Rated with a CVSS score of 7.8 (High), this vulnerability has a network attack vector and low attack complexity, allowing for complete availability impact (denial of service). Its EPSS score is low, indicating a low probability of exploitation in the wild. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. While there has been some community discussion and media coverage, it is not on the CISA KEV catalog or the Hot List, suggesting limited current threat relevance.